Steps to reproduce

• Check the sys_email record
• Check any affected incident number INCXXXXXXX
• You will find it was not updated properly, the sys_email record will show the next message:
• Unable to locate incident ___SYS_ID_NUMBER___ for inbound email processing

Troubleshooting

1. Go to the sys email record: /sys_email.do?xxxxxxx
2. Identify the user field for that record
3. Identify the target record from the email (incident number)
4. Right-click on 'Show XML'. You will see the next information:
   If you go here, right-click the header, and select 'Show XML' you can see information similar to this

   <sys_domain>XXXXXXXXXXX</sys_domain>
   <sys_domain_path>!!!/!!!/!!&/</sys_domain_path>

5. Compare both the user domain and the incident domain and they will be different

The incident belongs to a different domain than the user who sent the email

If you consider the user AAAA in the wrong domain or want to know why it is different than expected and when it has changed - you can enable auditing on the sys_user table through the Dictionary entry here:

https://<instance-name>.service-now.com/sys_dictionary_list.do?xxxxx

Consider either changing the domain of the user, or the domain of the incident.

Note: This issue could occur after upgrading an instance or modifying the user records.

Note: Ensure these actions are tested in sub-production instances before implemented in production environments.