Once RBL listing is turned on, you will have a bunch of log files under the following directory (provided Exchange was installed to the default C:\ directory):
C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\AgentLog
We want to track down which RBL provider blocked an email from a spammer with the from address of firstname.lastname@example.org but we first need to identify what log file contains the entry. To do this open a command prompt and navigate to the FrontEnd\AgentLogs directory.
Run the following command:
find /c "email@example.com" *.log | find ":" | find /v ": 0"
After running this command we can see that it found one entry for firstname.lastname@example.org in the file AGENTLOG20160313-1.LOG.
Open the log and search for the email in question.
We can see this email was blocked by zen.spamhaus.org RBL provider.
Hope this post was helpful.