Email Log Search: Get Details About Message Delivery
Track and get details about outgoing and incoming emails of users in your account.
Go to the Admin console https://admin.google.com and in the menu on the left, click Reporting > Email Log Search.
You can search for emails by:
You can only fill in only one of these fields or as many as you like.
For example, to find all emails sent to a user in your domain, enter the user’s email address as Recipient, and click SEARCH.
Once the search results come up, you can click the subject of an email to get more details.
Click the Download icon on the top right of the list of messages to export data.
Clicking a recipient’s email address under Recipient details will show you in great detail exactly what happened to the message, starting from the time the sender clicked Send to the time the recipient got it in their mailbox.
You can see the following Message details:
Subject: the email’s subject
Sender: The sender’s email address
Recipient: Email addresses that received the message. If there are multiple recipients, click the triangle to show all of them.
Date: the date the message was sent or the first time a log search entry appeared
Message ID: the unique ID of the email
Message size: the size of the message, including attachments
Attachments: the number of attached files
Expand results to all recipients – if you see this, it means your search terms limit the display of all recipients of an email. Click this option to override your search terms and display all other recipients of the email.
Status: the email’s delivery status
Archived – The email was sent to a Group where archiving is enabled. This means the message is viewable on the group’s page.
Accepted for archiving – The email has been received for archiving by Groups.
Bypassed spam – The email was marked as spam by Google but allowed to go through by a spam filter setting.
Bounced – The email bounced.
Delivered – The email was successfully delivered to the recipient. If the message is missing from the mailbox, note the IP address to which the mail was delivered, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.
Delivered to a Google internal server – The email is being delivered within Google’s internal network.
Delivered to an SMTP server – The email was delivered to the SMTP server with the specified email address and encryption.
Delivered to Gmail inbox – The email was delivered to the recipient, and no further action should be needed. If the message is missing, the user might have deleted it or moved it out of sight. Type in:anywhere <search string> in the search box to search all mailboxes and labels.
Delivered to group for distribution to members – The email was delivered to a group address for expansion to individual group members.
Dropped – The email was not delivered due to the bad reputation of the sending SMTP server.
For example, this server’s IP address may be on a DNS Blackhole List (DNSBL). These are IP addresses (or address ranges) associated with spamming activities.
Forwarded from group – The email was sent to the recipient via a Group.
In progress – The email is passing through Google’s servers and on the way to its destination.
Inserted into Gmail delivery pipeline – Google’s SMTP server received the email. It inserted it into the Gmail delivery pipeline for delivery to each Gmail account.
Inserted into Gmail delivery pipeline by the comprehensive mail storage service – This domain has turned on comprehensive mail storage. The Email Log Search shows the entry SYSTEM_OF_RECORD if an email is affected by this setting.
Marked Spam – The inbound email was classified as an unsolicited email in Gmail. To rectify misclassified messages, mark them as Not Spam.
Quarantined – The email triggered a setting that resulted in the message being quarantined.
Received from a Google internal server – The inbound email was initially sent from a Google Workspace account, possibly in your organization. If this status appears multiple times in the Recipient details for a message, the message likely originated from a Google Workspace account outside of the recipient domain.
Received from an SMTP server – The inbound email was received from a message transfer agent (MTA) at the IP address shown. This line also indicates whether the message was encrypted via Transport Layer Security(TLS). If you’re using SSL/TLS IMAP with Outlook and messages are received with TLS, the messages are encrypted between the Gmail server and the host that sent it.
Rejected – The email is being marked as spam by automatic outbound spam filtering.
Rejected from quarantine – An administrator deleted the email from the spam quarantine.
Released from quarantine – An administrator released the email from the spam quarantine.
Sent for archiving – The email was sent for Group archiving.
Sent for moderation – This email is part of a Group discussion. It has been sent to the moderation queue for review by the group’s moderators.
Sent from Gmail – The email was sent from Gmail.
Sent to group members – The email was sent to the individual group members.
—
You also see the Post-delivery message details at the bottom. This is the status of a message in a user’s mailbox or an indication that the message has been deleted. It’s not available for external, deleted, and non-Gmail accounts.
Here is a list of all post-delivery statuses:
Label – A comma-separated list of non-Inbox labels is assigned to the email.
Marked important – The email is marked as important.
Marked unimportant – The email is marked as unimportant.
Opened and marked unread – The email was opened and viewed and was then marked as unread.
Opened and read – The email was opened and viewed.
Seen – The email was listed in the user’s view when the user accessed Gmail.
Spam – The email is currently marked as spam.
Starred – The email is currently starred.
Unopened and marked read – The email was never opened and viewed but is marked as read.
Unopened and unread – The email was never opened and never viewed.
Unseen – The email is yet to be loaded in the user’s view.
Track and get details about outgoing and incoming emails of users in your account.
Access information related to all administrator activity in your Google Admin console.
Access information related to the login activity of users in your account.
Access information related to the Google Drive activity of users in your account.
Access information related to the Google Calendar activity of users in your account.
Access information related to Google Groups activity in your account.
Access information related to the Google Chat activity in your account.
Access information related to the Google Meet activity of users in your account.
Access information related to the Google Takeout activity of users in your account.
Access information related to the mobile device activity of users in your account.
Access information related to third-party app authorization by users in your account.
Access information related to the SAML app login activity of users in your account.
Access information related to the Google Keep activity of users in your account.
Access information related to Google Currents activity of users in your account.
© 2022 Workspace123. All rights reserved. | Terms of Service | Privacy Policy
Think we could do something better or just want to tell us how happy you are with the site? We would love to hear from you – your feedback is more valuable than you can imagine.
Fill out this form, and we will get back to you.
Are you running into an issue with the site? Maybe you found a broken link, or something else is wrong?
Fill out this form to let us know, and we will address it as soon as possible.
Please make sure to be very specific and add as many details as possible.
Our goal is to run the number one site in the world for you to get help with and learn how to use Google Workspace. This can’t be so if there is any missing information.
If you believe we need to add something, fill out this form, and we will do our best to add any missing content as soon as possible.
This site uses cookies to ensure you get the best experience. Click here to see our Cookies Policy.
You can stay on top of news and updates in Google Workspace and Workspace123 and get special offers by subscribing to our newsletter.