Greetings, all.
The specific goal is to locate all e-mails that were sent to external recipients; thus, I thought NOT agent in combination with specific Options selections would remove all exchanges containing an internal e-mail address in any of the recipient fields, but this approach did not work at all.
My understanding is that the query NOT agent:*@domain_not_wanted.xxx should exclude all e-mails with a @domain_not_wanted.xxx e-mail address. However, the query is actually pulling all items with a @domain_not_wanted.xxx e-mail address in any of the address fields (To, Cc, etc.).
I also tried to be more specific and used agent:*@domain_wanted.xxx AND NOT agent:*@domain_not_wanted.xxx. This brought all items with either @domain_wanted.xxx or @domain_not_wanted.xxx e-mail addresses.
Using Options to select only address fields did not alter the result.
Any pointers are greatly appreciated.