Hello,

Have you tried to set the delivery log to detailed and search the log for deliveries for this mailbox.

You should find in the log the reason why it went to Deleted Items, or at least some informations about that could help finding out what is going on.

Kind regards

Thank you Sebastian for your reply.

I have indeed looked into the logs. Here is a log part from a typical such problematic delivery.
I cannot discern any distinguishable cause for the problem.

[2021.03.15] 14:38:07.321 [57735052] Delivery started for sender@xxx.com at 2:38:07 μμ
[2021.03.15] 14:38:10.324 [57735052] Added to SpamCheckQueue (1 queued; 0/30 processing)
[2021.03.15] 14:38:10.324 [57735052] [SpamCheckQueue] Begin Processing.
[2021.03.15] 14:38:10.325 [57735052] Blocked Sender Checks started.
[2021.03.15] 14:38:10.325 [57735052] Blocked Sender Checks completed.
[2021.03.15] 14:38:10.349 [57735052] Spam Checks started.
[2021.03.15] 14:38:12.140 [57735052] Spam Check results: [REVERSE DNS LOOKUP: 0,Passed], [_INTERNALSPAMASSASSIN: 5:7], [_SPF: -2,Pass], [_DKIM: 0,None], [HOSTKARMA - BLACKLIST: 0,passed], [HOSTKARMA - BROWNLIST: 0,passed], [HOSTKARMA - WHITELIST: 0,passed], [SORBS - ABUSE: 0,passed], [SORBS - DYNAMIC IP: 0,passed], [SORBS - PROXY: 0,passed], [SORBS - SOCKS: 0,passed], [SPAMCOP: 0,passed], [SPAMHAUS - PBL: 0,passed], [SPAMHAUS - PBL2: 0,passed], [SPAMHAUS - SBL: 0,passed], [SPAMHAUS - XBL: 0,passed], [SPAMHAUS - XBL2: 0,passed], [UCEPROTECT LEVEL 1: 0,passed], [UCEPROTECT LEVEL 2: 0,passed], [UCEPROTECT LEVEL 3: 0,passed]
[2021.03.15] 14:38:12.140 [57735052] Spam Checks completed.
[2021.03.15] 14:38:12.140 [57735052] Removed from SpamCheckQueue (0 queued or processing)
[2021.03.15] 14:38:13.354 [57735052] Added to LocalDeliveryQueue (0 queued; 1/50 processing)
[2021.03.15] 14:38:13.354 [57735052] [LocalDeliveryQueue] Begin Processing.
[2021.03.15] 14:38:13.355 [57735052] Starting local delivery to recepient@yyy.com
[2021.03.15] 14:38:13.382 [57735052] Delivery for sender@xxx.com to recepient@yyy.com has completed (Delivered to Deleted Items) Filter: None
[2021.03.15] 14:38:13.382 [57735052] End delivery to recepient@yyy.com (MessageID: <PR1PR06MB58206AFB63AE4BC17C40E2EEFF6C9@PR1PR06MB5820.eurprd06.prod.outlook.com>)
[2021.03.15] 14:38:13.383 [57735052] Removed from LocalDeliveryQueue (0 queued or processing)
[2021.03.15] 14:38:16.359 [57735052] Removing Spool message: Killed: False, Failed: False, Finished: True
[2021.03.15] 14:38:16.359 [57735052] Delivery finished for sender@sender.com at 2:38:16 μμ    [id:202057735052]

Server Antispam is operation with the default configuration options.
Feel free to share any thoughts.

Thank you again

Miltos Paraskevaidis

Can we have you post the headers of the received message after obscuring the recipient/sender information? I'd like to see what kind of spam score these messages are being awarded. Thanks!

Kyle thank you for your answer,

Here is the message headers below with recipient/sender info masked 

----------------------------------------------------------------------------------------------

Delivered-To: reciepient@reciepient.com
Received-SPF: pass (zohomail.com: domain of sender.com designates 13.95.85.160 as permitted sender) client-ip=13.95.85.160; envelope-from=sender@sender.com; helo=mail.douroazul.pt;
Authentication-Results: mx.zohomail.com;
spf=pass (zohomail.com: domain of sender.com designates 13.95.85.160 as permitted sender) smtp.mailfrom=sender@sender.com;
arc=pass (i=1dmarc=pass fromdomain=sender.com)
ARC-Seal: i=2; a=rsa-sha256; t=1615811585; cv=pass;
d=zohomail.com; s=zohoarc;
b=Bn7VzIbrUmyKgFporm7E5LcnCcEjsCTZY8YIIakfbKkKGz8d7waXJm1dQzdLLH4/iYlH3gONkuq0JEkWPz2tUbQVd/D71OtvTC9HGxV4KL3JiavNWL1DX+WgAyTKMvnLNVODZWxgReph8oRI/E+oL4hKmhJrgDCX/8Eq48PHv4o=
ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc;
t=1615811585; h=Content-Type:Date:From:In-Reply-To:MIME-Version:Message-ID:Subject:To;
bh=fG0VZMDIuj8dYI3scl7QXRtYPpPHLdnPe5twlPkpX0s=;
b=Lm86UT4KCMXaj3tR+lmbORwOlDUZflmY/5em20QI4D1udamvW/DDYGLjd+PQCEDnYPI9bQnmcaOd2SqoTVN/ijCzrYnQzFAWLl6xLoFrtELj29RTqrPd0RFnFHvKozYlNOaF9xNmDCXUn7sZLZMK8x1SSrmW2gALi7EvHc+t5Z0=
ARC-Authentication-Results: i=2; mx.zohomail.com;
spf=pass (zohomail.com: domain of sender.com designates 13.95.85.160 as permitted sender) smtp.mailfrom=sender@sender.com;
arc=pass (i=1dmarc=pass fromdomain=sender.com)
Received: from mail.douroazul.pt (mx01.sender.com [13.95.85.160]) by mx.zohomail.com
with SMTPS id 1615811584510687.3571004529351; Mon, 15 Mar 2021 05:33:04 -0700 (PDT)
Return-Path: <sender@sender.com>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=MTa0nYwXGyBYs0SmDBkH7Pdlwgp4HEpDNEAjk7okU7UK/SJlvpqjJFniWOLhuskAps7qubQJywpD7K6jkjZD8hDoo95fVgJhyJwvw9eDKRZVHorfKBt5l1JeQEf91P4Onqac267PiF09I364fegT4mtE9YviUQryx/5azYs1XHFRLS3KJZCcMHpiCv6FqElDJbR6t5Ya0RKAF0ZTX9boUFXz3lKLBPWEGY4Ee4m51qGZWVrnWzlppWWuZcGJ2Qy0Os7EJ3+fpJjJKv+HL615QSpGmzXZRirhGGWUbwgKMfOjfwm89QbPY3gZdmiLplF9sg34FoTQ8hUO14Y5+NHeqg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=fG0VZMDIuj8dYI3scl7QXRtYPpPHLdnPe5twlPkpX0s=;
b=OrxiPz658kUCsdNS2T2QT5UOkwF5Y74ZOmCScczHUx23j2OYAIvjugDAmhOltuvrXnNLCxtpKS0c1hWM1N2WddpjPTaRA0WxuH5gmygo0VTFL7Vm64fPnWYH0qoe1je2zRTh0v8AbDAfS9yrE0H+uNz5duxq2cyRJEPR9e654S7yldTVadOjAaT2l3FyzwTUoN2DlDXY8VnNL4HEVZwUW52zfbCb2SPuwDYY/a59zU2GhZCHPevECZ0m9+fdzGmsXToShuV7Dqxk4PcC4Ul6YaJ6B2FfVy5AjF09/9BposjsrJUpIMLpHwYltCj0QmkKCTziiYYGpmtU9CdrELI6qA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=sender.com; dmarc=pass action=none
header.from=sender.com; dkim=pass header.d=sender.com; arc=none
From: Ricardo Borges <sender@sender.com>
To: "reciepient@reciepient.com"
<reciepient@reciepient.com>
Subject: Lida:Completed 21-RFI Forms/Revised
Thread-Topic: Completed 21-RFI Forms/Revised
Thread-Index: AQHXGY5YhxwXVzEzoUazvWVbHixiS6qE+089
Date: Mon, 15 Mar 2021 12:32:57 +0000
Message-ID: <PR1PR06MB58206AFB63AE4BC17C40E2EEFF6C9@PR1PR06MB5820.eurprd06.prod.outlook.com>
In-Reply-To: <58177b0326ff4499b71ef669836bdb8b@reciepient.com>
Accept-Language: pt-PT, en-US
Content-Language: pt-PT
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Authentication-Results: mail.douroazul.pt;
spf=pass (douroazul.pt: domain of sender@sender.com designates 104.47.24.104 as permitted sender) smtp.mailfrom=sender@sender.com
authentication-results: reciepient.com; dkim=none (message not signed)
header.d=none;reciepient.com; dmarc=none action=none
header.from=sender.com;
x-originating-ip: [62.28.175.250]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 50ab0afc-d35d-4652-4353-08d8e7ae76eb
x-ms-traffictypediagnostic: PR1PR06MB5770:
x-microsoft-antispam-prvs: <PR1PR06MB57702E8CA1614F392AF06CC7FF6C9@PR1PR06MB5770.eurprd06.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:1728;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: oAvpX0athk0uoduoM/LRoeqAuv2Y2zHo0R5P2IEaFfRCqRCsofAaWpV/3aQ7PlFr9p7gQ4GE0HvxbYHB/v8irZdnTjeYEHPdyPX/CShYg68eS1vYQYkEe4Qdr1nGpIemiVFbvUl8PORMdUKJALg5SGU5FySpIj4yjVzzq6XxckgzXU716Mjm9CmODsACDhXjFFWl+ckGYUnrYSD34cxwdHMdaddBeImDYvI9GuokVO+H1uu17Dp9zlSTCAqPY9DUn+lGyFgH2zfDXAxDu1uaXxoNgZ/gYSID8kL8iiPrVAI=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PR1PR06MB5820.eurprd06.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(136003)(366004)(376002)(346002)(396003)(39850400004)(44832011)(26005)(55016002)(8676002)(9686003)(478600001)(76116006)(316002)(621065003)(73894004)(186003)(86362001)(2906002)(66556008)(71200400001)(66946007)(66476007)(64756008)(7696005)(8936002)(33656002)(66446008)(4270600006)(6916009)(52536014)(6506007);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata: =?iso-8859-1?Q?TbDg+6WVjxOkxSiPCpSIHNQbhxd+2/dqhP6TjYw7IoorKwYioH3fHkSYDY?=
=?iso-8859-1?Q?1GeB7A9uEttaqF7DNZBFyp5Wj2czkLc+kQhoFwrzBdNXSqZJfFuOuCZkyt?=
=?iso-8859-1?Q?CgHn5F5U14wG1h160Hhs/X86sCrppUrPy4Aj7NlFmqDwl557dEmbOhKo3D?=
=?iso-8859-1?Q?V+2bLEaoqz8jFioU2B+OsGzc4XegjE033cUvevYCEyMIfVh1KMjPX7ZZAQ?=
=?iso-8859-1?Q?ge9hpleRljTsuQVmVS8bQEhLmRQbY8nZfIq1dbcu8SWqMPOGj1x7FdbVeX?=
=?iso-8859-1?Q?yE26L95P5TsFmD3iC6rwAkwHHBLR03Je4fRo+XgO3XXBt2aDENsxbvldEn?=
=?iso-8859-1?Q?KLr1hXIk2w17uqOuDN0a2pI/SByyx0AkjV5txJ8uRBjfC9EU/nVcPei99w?=
=?iso-8859-1?Q?c6W/pX77fsxzDFdCxrZZHmQlMix3Hz10pBZwyMDXilgvEvo02biOF7aAWX?=
=?iso-8859-1?Q?ngejT/WuNNPg2EBuKTCdMU3pvmYo5pXAocCX3OKYULw4mXI3bY6x2lS9j3?=
=?iso-8859-1?Q?n68uxt/cdLoWcQxJGqMPsWSMj6qTVuyBgXonufYjCD/r3UrSikZYVDsz4w?=
=?iso-8859-1?Q?dnui4dJ/ZcbvLIqCaYf6fNkxT0s47+f0V/JWF8vXwjZkuPyxxsCazFowe8?=
=?iso-8859-1?Q?NgVDA/aBvsDI9Br5n14L2CNMUMv+h8gmXCB1BHSAmto7JVP0p4h5bmtV4t?=
=?iso-8859-1?Q?f8n8h+K7QodUKxH3FljZkxLng6uU4K2ocVsHcyffEUIPHjv0FAbSHXjbsj?=
=?iso-8859-1?Q?mNXUXs+ngfvukwOyqL2IpPSK78qqIny+L4YqRUYp4GoOfOt54RIDh8rVGQ?=
=?iso-8859-1?Q?mSmLLThzYoPkWPSLmkadB98KI+jWE7CBj8px4np1WW4C/iGjW9b085R85X?=
=?iso-8859-1?Q?JowW9XYbhJ5vuYFYUYNyWltI6WpEaYll+gg1mJTd+2Yc9gwUAu7n0k3+Yo?=
=?iso-8859-1?Q?OZBzSAQjqUTKzVX0AKDKvqRJYVdqZrYr6BCKETKGubmJWfBZCK+UcuPntF?=
=?iso-8859-1?Q?104pwgS5ZaSOS2/+m0u4KX0Fvy5xoiSzjtRQML7Ipasp7/ixoQ+qAQhkBd?=
=?iso-8859-1?Q?T8K30H8HZeBMAQRo5IGYIXFz3g//mnNfB1pKVsdaPEdaQBLcv9c9Gmouj6?=
=?iso-8859-1?Q?8LH63E5FDnIWtJ1hK2R3W0aRAxKtpuDvcnwfad86Kv9M1/glcY5aFOe0F0?=
=?iso-8859-1?Q?hjj9G7p+uBRKvsmL23BpleY1GamkqOWZooE1A/1Qo+UhY0YBjNsHnU07d1?=
=?iso-8859-1?Q?K4UQoA0zjZVLqGwSTEyZO3GSpEAZ7nYRkiEsEcZwiTJOo0DQbM77jOsHv7?=
=?iso-8859-1?Q?0mqwKiXxktwBmqCnFfZtl5T7jmM5+j443ZbE4XJ4BC+arIL3yPRqUpSfI4?=
=?iso-8859-1?Q?4/42sOBvrm?=
x-ms-exchange-transport-forked: True
Content-Type: multipart/report;
boundary="_000_PR1PR06MB58206AFB63AE4BC17C40E2EEFF6C9PR1PR06MB5820eurp_";
report-type=disposition-notification
MIME-Version: 1.0
X-OriginatorOrg: sender.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PR1PR06MB5820.eurprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 50ab0afc-d35d-4652-4353-08d8e7ae76eb
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2021 12:32:57.7321
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f1898c48-85d4-4242-b23d-ffc892ccaa82
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 6IYaK72D+1ScfSoeGMiXu1cx4Xpkm/9idizVCIudpJnROm8z2AB/Y8Ok37w2viZPb9kYWyYXCG0kIscABE9L6cp7bh5+AdoBZ12VjMeJPf4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR1PR06MB5770
X-FEAS-SPF: spf-result=pass, ip=104.47.24.104, helo=fra01-pr2-obe.outbound.protection.outlook.com, mailFrom=sender@sender.com
X-ZohoMail-Owner: <PR1PR06MB58206AFB63AE4BC17C40E2EEFF6C9@PR1PR06MB5820.eurprd06.prod.outlook.com>+zmo_0_sender@sender.com
X-Antivirus: AVG (VPS 210315-0, 15/03/2021), Inbound message
X-Antivirus-Status: Clean
X-SmarterMail-Spam: Reverse DNS Lookup [Passed]: 0, ISpamAssassin [raw:5]: 7, SPF [Pass]: -2, DKIM [None]: 0
X-SmarterMail-TotalSpamWeight: 5

Thanks for your help in advance

Miltos Paraskevaidis