I have Xeams set up as an email server.

All looks to be ok - but I have items in the OutboundAuditTrailFailure.log which I don't understand as I haven't sent any emails to this address.

All the emails in this list are inbound messages.

2019-07-24 18:35:02,896 - [      2343] 104.47.8.36,yyyyy@skiline.co.uk,,1924,[Failure reason: Unable to send email to the server. 
550 5.7.606 Access denied, banned sending IP [81.109.182.231]. To request removal from this list please visit https://sender.office.com/ and follow the directions. 
For more information please go to  http://go.microsoft.com/fwlink/?LinkID=xxxxxx (ASyyyyyyyy) [AM5EURiiFTiii.eop-EURii.prod.protection.outlook.com]
],Subject:  Delivery Status Notification(FAILURE)

I am pulling in emails using POP3 fetcher and delivering to a local email address not available to the outside world.

Hope someone can help.

M

Try searching for the email in Message Repository using either the subject or the Sender/Recipient's address. Once found, check the headers or click Analyze button to see where did the message come from.

Thanks - I've done that.

Details say

And analysis says

Does any of this explain why its going through the outbound queue.

The section for "Intermediate Hops" is missing in your screenshot. That section contains the IP address.

In any case, contact us via email and send us the *.eml file for this message. We will be able to tell you by looking at the headers. You should be able to download the *.eml file by clicking the disk icon in Message Repository. See image below.