Key takeaways

  • During an outage, incoming mail usually queues at the sender and is retried, but your staff cannot read or send until service returns.
  • Email continuity means an independent path to send, receive and read mail when the main platform is unavailable.
  • Check Microsoft 365 service health in the admin center, and have a way to see it that does not depend on your own email.
  • Plan communications outside the affected system: a phone tree, a text service and a printed contact list.
  • Continuity is not backup. A backup restores data later. Continuity keeps people working now.

Start with the answer: when Microsoft 365 is down, most incoming messages are not lost. Sending servers hold them and try again for days. The harm is that your staff cannot read, send or reply for as long as the outage lasts, and often calendars, Teams and files fail at the same time. Email continuity is the set of tools and habits that give you a second way to work: an independent service that keeps receiving, lets users send and read, and then syncs everything back when the main platform returns.

What happens to mail during an outage

Internet email is built to be patient. If a sending server cannot deliver, it queues the message and retries. The email standard says senders should keep trying for several days before giving up, and most do. Messages for your domain wait while your platform is unreachable and are delivered once it recovers. That is why outages rarely mean lost mail. But some senders give up sooner, some systems send a delay or bounce notice, and automated messages such as password resets and one-time codes expire long before a retry. For a business that lives on email, a few hours without it is already costly.

Where to look: service health

  • The Microsoft 365 admin center shows service health, advisories and incidents for your tenant, and lists affected services and updates. It needs you to sign in, which may not work if the identity service is the thing that failed.
  • Microsoft publishes a public service status page and status updates on social media for widespread incidents.
  • Microsoft Learn describes how to view service health and how to subscribe to notifications by email or by the admin mobile app.
  • Assign a person to check these and report to leadership, so everyone is not refreshing the same page.

Plan for the case where your own email does not work. Send alert notifications to a second address that is not on your Microsoft 365 domain, or to a messaging channel the incident team already uses.

What breaks besides email

A tenant-wide issue can hit sign-in, so people cannot reach Teams, SharePoint or OneDrive as well. Phone systems integrated with Teams may drop. Applications that send mail through Exchange Online, such as scanners, invoicing and ticket systems, stop sending. Multi-factor authentication prompts may fail. Map these dependencies before an incident, not during it.

What email continuity does

There are several designs, and they differ in effort and cost. A good service offers most of the following.

  • Inbound capture: your mail flows through a filtering and queuing layer that stores incoming mail while the main platform is down, so it arrives in a safe place rather than waiting at the sender.
  • Emergency mailbox: staff can read mail from the last period, and send and reply from a web portal or a simple client, using your own domain.
  • Automatic switching: the service detects the outage and turns on emergency mode, or a trained person does it from a runbook.
  • Resync: when Microsoft 365 returns, messages sent and received in emergency mode are merged back so nothing is missing from the main mailbox.
  • Archive access: a searchable archive of past mail so people can find an old message or attachment during the outage.

Because the filtering layer sits in front of your platform, it also stops spam and malicious messages, and it can feed an archive. This is why continuity, security and archiving are often delivered together.

Things to be careful about

  • Mail routing is set by your domain's MX records in DNS. Changing them during an incident is slow and error-prone, so decide the design in advance and test it.
  • A backup mail server that is not filtered becomes an easy route for spam and malware. Secondary routes must apply the same security.
  • Continuity users need their own access. If the emergency portal uses the same sign-in that has failed, it does not help.
  • Do not forget mobile devices, shared mailboxes and service accounts.
  • Keep sender authentication in mind. SPF, DKIM and DMARC records need to include the continuity service, or its messages may be rejected.

Outside email: a communications plan

A real outage plan does not assume email works. Keep a printed and offline contact list for staff, key clients and vendors. Agree on a channel for internal updates, such as a text broadcast or a phone tree. Decide who speaks to clients and what they say. Draft a short holding statement in advance. Know which tasks can wait and which, such as payroll and payments, must continue, and how you will confirm instructions by phone rather than by email, which also guards against fraud attempts that take advantage of confusion.

Test it

Once or twice a year, run an exercise: pretend email is down for four hours. Switch to the emergency path, send and receive, check that staff know how to sign in, and measure how long the switch took. Then confirm that the resync works. Write down what you learn and fix it. Also keep your continuity plan with your backup and disaster recovery documents, since email is one part of the larger plan.

A short checklist

Know how to check service health without your email. Put a filtering and queuing layer in front of your mail. Set up an emergency mailbox and test the switch. Update SPF, DKIM and DMARC for the service. Keep an offline contact list and a communications plan. Rehearse every year. Our team designs and operates email security, archiving and continuity. Start with our Email Security, Archiving and Continuity service.

Sources

This article is general information. Service behavior, tools and addresses change; confirm details in current vendor documentation and with your IT provider. Last reviewed .

Keep reading

Need help with this?

Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.

Email Security, Archiving & Continuity