How to Use the Google Workspace Email Log Search and Track Email Message Delivery

Quick and easy-to-follow guide for Google Workspace administrators

What is the Email Log Search feature in Google Workspace

  • The Email Log shows you information about users’ and groups’ sent/received emails in the last 30 days. Most importantly, it shows the delivery status of emails.
  • If emails don’t reach their recipient, you can use the Email Log Search, and you will know why.
  • Emails may have been quarantined as spam or bounced, and you can easily see this in the log. 
  • The only case where you won’t find an email in the Email Log is when it never reached Google’s servers. In this case, if the recipient was in your domain, this means there was a sending issue coming from the sending side, and you must ask the sender to investigate.

When to use the Email Log Search

  • When you want to track email message delivery from or to email addresses in your Google Workspace account
  • Anytime you need to troubleshoot a delivery issue or find out why someone claims they have not received an email

Email Log Search data availability and retention

  • In most cases, the log can find information about an email right away. In some cases, it can take up to 1-3 days.

How to use the Google Workspace Email Log Search step-by-step with images

Step 1

Google Workspace Email Log Search - Step 1

Go to the Admin console https://admin.google.com and in the menu on the left, click Reporting > Email Log Search.

Step 2

Google Workspace Email Log Search - Step 2

You can search for emails by:

  • Date: the date range during which the email was sent/received
  • Sender: the sender of the email
  • Recipient: the recipient of the email
  • Sender IP: the sender’s IP address
  • Recipient IP: the recipient’s IP address
  • Subject: the email’s subject
  • Message ID: the email’s unique ID. You can get it from the message header.


​You can only fill in only one of these fields or as many as you like.

​For example, to find all emails sent to a user in your domain, enter the user’s email address as Recipient, and click SEARCH.

Step 3

Google Workspace Email Log Search - Step 3

Once the search results come up, you can click the subject of an email to get more details.

Exporting Email Log Search results

Click the Download icon on the top right of the list of messages to export data.

Step 4

Google Workspace Email Log Search - Step 4

Learn to understand Email Log Search results

Clicking a recipient’s email address under Recipient details will show you in great detail exactly what happened to the message, starting from the time the sender clicked Send to the time the recipient got it in their mailbox.

You can see the following Message details:

Subject: the email’s subject

Sender: The sender’s email address

Recipient: Email addresses that received the message. If there are multiple recipients, click the triangle to show all of them.

Date: the date the message was sent or the first time a log search entry appeared

Message ID: the unique ID of the email

Message size: the size of the message, including attachments

Attachments: the number of attached files

Expand results to all recipients – if you see this, it means your search terms limit the display of all recipients of an email. Click this option to override your search terms and display all other recipients of the email.

Status: the email’s delivery status

Archived – The email was sent to a Group where archiving is enabled. This means the message is viewable on the group’s page.

Accepted for archiving – The email has been received for archiving by Groups.

Bypassed spam – The email was marked as spam by Google but allowed to go through by a spam filter setting.

Bounced – The email bounced.

Delivered – The email was successfully delivered to the recipient. If the message is missing from the mailbox, note the IP address to which the mail was delivered, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.

Delivered to a Google internal server – The email is being delivered within Google’s internal network.

Delivered to an SMTP server – The email was delivered to the SMTP server with the specified email address and encryption.

Delivered to Gmail inbox – The email was delivered to the recipient, and no further action should be needed. If the message is missing, the user might have deleted it or moved it out of sight. Type in:anywhere <search string> in the search box to search all mailboxes and labels.

Delivered to group for distribution to members – The email was delivered to a group address for expansion to individual group members.

Dropped – The email was not delivered due to the bad reputation of the sending SMTP server.
For example, this server’s IP address may be on a DNS Blackhole List (DNSBL). These are IP addresses (or address ranges) associated with spamming activities.

Forwarded from group – The email was sent to the recipient via a Group.

In progress – The email is passing through Google’s servers and on the way to its destination.

Inserted into Gmail delivery pipeline – Google’s SMTP server received the email. It inserted it into the Gmail delivery pipeline for delivery to each Gmail account.​

Inserted into Gmail delivery pipeline by the comprehensive mail storage service – This domain has turned on comprehensive mail storage. The Email Log Search shows the entry SYSTEM_OF_RECORD if an email is affected by this setting.

Marked Spam – The inbound email was classified as an unsolicited email in Gmail. To rectify misclassified messages, mark them as Not Spam.

Quarantined – The email triggered a setting that resulted in the message being quarantined.

Received from a Google internal server – The inbound email was initially sent from a Google Workspace account, possibly in your organization. If this status appears multiple times in the Recipient details for a message, the message likely originated from a Google Workspace account outside of the recipient domain.

Received from an SMTP server – The inbound email was received from a message transfer agent (MTA) at the IP address shown. This line also indicates whether the message was encrypted via Transport Layer Security(TLS). If you’re using SSL/TLS IMAP with Outlook and messages are received with TLS, the messages are encrypted between the Gmail server and the host that sent it.

Rejected – The email is being marked as spam by automatic outbound spam filtering.

Rejected from quarantine – An administrator deleted the email from the spam quarantine.

Released from quarantine – An administrator released the email from the spam quarantine.

Sent for archiving – The email was sent for Group archiving.

Sent for moderation – This email is part of a Group discussion. It has been sent to the moderation queue for review by the group’s moderators.

Sent from Gmail – The email was sent from Gmail.

Sent to group members – The email was sent to the individual group members.


You also see the Post-delivery message details at the bottom. This is the status of a message in a user’s mailbox or an indication that the message has been deleted. It’s not available for external, deleted, and non-Gmail accounts.

Here is a list of all post-delivery statuses:

Label – A comma-separated list of non-Inbox labels is assigned to the email.

Marked important – The email is marked as important.

Marked unimportant – The email is marked as unimportant.

Opened and marked unread – The email was opened and viewed and was then marked as unread.

Opened and read – The email was opened and viewed.

Seen – The email was listed in the user’s view when the user accessed Gmail.

Spam – The email is currently marked as spam.

Starred – The email is currently starred.

Unopened and marked read – The email was never opened and viewed but is marked as read.

Unopened and unread – The email was never opened and never viewed.

Unseen – The email is yet to be loaded in the user’s view.

That's all! You reached the end of the article. Continue to:

If you find this useful, share and help others!

Email
Reddit
Facebook
Telegram
Twitter
LinkedIn
Pinterest
Protect And Secure Google Workspace
Backup and protect your data
Data protection and security tools are crucial, especially if you store any sensitive data in your accounts.
Email Marketing Tools
Better Gmail and email marketing
If you work with Gmail or do email marketing, you will appreciate what these services can do for you.
Collab And Optimization Tools
Process optimization and collaboration
You can use these services to make tedious processes a whole lot easier, improve teamwork, save time, and get better results.
Website Tools and Resources
Resources for website creators
Awesome tools and services for easy and effective site building, content creation, SEO, email marketing, and more.

Submit Feedback

Think we could do something better or just want to tell us how happy you are with the site? We would love to hear from you – your feedback is more valuable than you can imagine.

Fill out this form, and we will get back to you.

Report An Issue With Workspace123

Are you running into an issue with the site? Maybe you found a broken link, or something else is wrong?

Fill out this form to let us know, and we will address it as soon as possible.

Please make sure to be very specific and add as many details as possible.

Missing Content

Our goal is to run the number one site in the world for you to get help with and learn how to use Google Workspace. This can’t be so if there is any missing information.

If you believe we need to add something, fill out this form, and we will do our best to add any missing content as soon as possible.

This site uses cookies to ensure you get the best experience. Click here to see our Cookies Policy.

Be the first to know

You can stay on top of news and updates in Google Workspace and Workspace123 and get special offers by subscribing to our newsletter.

Subscribe by email for news and updates