How to Use the Google Workspace Email Log Search and Track Email Message Delivery

Clicking a recipient’s email address under Recipient details will show you in great detail exactly what happened to the message, starting from the time the sender clicked Send to the time the recipient got it in their mailbox.

You can see the following Message details:

Subject: the email’s subject

Sender: The sender’s email address

Recipient: Email addresses that received the message. If there are multiple recipients, click the triangle to show all of them.

Date: the date the message was sent or the first time a log search entry appeared

Message ID: the unique ID of the email

Message size: the size of the message, including attachments

Attachments: the number of attached files

Expand results to all recipients – if you see this, it means your search terms limit the display of all recipients of an email. Click this option to override your search terms and display all other recipients of the email.

Status: the email’s delivery status

Archived – The email was sent to a Group where archiving is enabled. This means the message is viewable on the group’s page.

Accepted for archiving – The email has been received for archiving by Groups.

Bypassed spam – The email was marked as spam by Google but allowed to go through by a spam filter setting.

Bounced – The email bounced.

Delivered – The email was successfully delivered to the recipient. If the message is missing from the mailbox, note the IP address to which the mail was delivered, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.

Delivered to a Google internal server – The email is being delivered within Google’s internal network.

Delivered to an SMTP server – The email was delivered to the SMTP server with the specified email address and encryption.

Delivered to Gmail inbox – The email was delivered to the recipient, and no further action should be needed. If the message is missing, the user might have deleted it or moved it out of sight. Type in:anywhere <search string> in the search box to search all mailboxes and labels.

Delivered to group for distribution to members – The email was delivered to a group address for expansion to individual group members.

Dropped – The email was not delivered due to the bad reputation of the sending SMTP server.
For example, this server’s IP address may be on a DNS Blackhole List (DNSBL). These are IP addresses (or address ranges) associated with spamming activities.

Forwarded from group – The email was sent to the recipient via a Group.

In progress – The email is passing through Google’s servers and on the way to its destination.

Inserted into Gmail delivery pipeline – Google’s SMTP server received the email. It inserted it into the Gmail delivery pipeline for delivery to each Gmail account.​

Inserted into Gmail delivery pipeline by the comprehensive mail storage service – This domain has turned on comprehensive mail storage. The Email Log Search shows the entry SYSTEM_OF_RECORD if an email is affected by this setting.

Marked Spam – The inbound email was classified as an unsolicited email in Gmail. To rectify misclassified messages, mark them as Not Spam.

Quarantined – The email triggered a setting that resulted in the message being quarantined.

Received from a Google internal server – The inbound email was initially sent from a Google Workspace account, possibly in your organization. If this status appears multiple times in the Recipient details for a message, the message likely originated from a Google Workspace account outside of the recipient domain.

Received from an SMTP server – The inbound email was received from a message transfer agent (MTA) at the IP address shown. This line also indicates whether the message was encrypted via Transport Layer Security(TLS). If you’re using SSL/TLS IMAP with Outlook and messages are received with TLS, the messages are encrypted between the Gmail server and the host that sent it.

Rejected – The email is being marked as spam by automatic outbound spam filtering.

Rejected from quarantine – An administrator deleted the email from the spam quarantine.

Released from quarantine – An administrator released the email from the spam quarantine.

Sent for archiving – The email was sent for Group archiving.

Sent for moderation – This email is part of a Group discussion. It has been sent to the moderation queue for review by the group’s moderators.

Sent from Gmail – The email was sent from Gmail.

Sent to group members – The email was sent to the individual group members.

​
—

You also see the Post-delivery message details at the bottom. This is the status of a message in a user’s mailbox or an indication that the message has been deleted. It’s not available for external, deleted, and non-Gmail accounts.

Here is a list of all post-delivery statuses:

Label – A comma-separated list of non-Inbox labels is assigned to the email.

Marked important – The email is marked as important.

Marked unimportant – The email is marked as unimportant.

Opened and marked unread – The email was opened and viewed and was then marked as unread.

Opened and read – The email was opened and viewed.

Seen – The email was listed in the user’s view when the user accessed Gmail.

Spam – The email is currently marked as spam.

Starred – The email is currently starred.

Unopened and marked read – The email was never opened and viewed but is marked as read.

Unopened and unread – The email was never opened and never viewed.

Unseen – The email is yet to be loaded in the user’s view.