This feature is available with G Suite Enterprise, Business, or Basic edition. (Compare editions)
You can sift through the delivery logs for your domains and evaluate message delivery using Email Log Search in the Google Admin console. The reports help you track down missing messages, such as those quarantined as spam or otherwise routed incorrectly. You can also use the tool to determine message IP addresses and troubleshoot how policies affect mail flow.
In addition to tracking the delivery of a message, you can use Email Log Search to investigate the status of a message after it has been delivered to a user's Gmail mailbox. This includes the current assigned labels, message location, and whether or not the message has been deleted.
The Email Log Search tool isn't available to resellers when accessing a resold domain Admin console using the reseller console.
How do I start using the tool?
- Learn about the tool—Use this article for guidelines.
- Perform a search—See Find messages with Email Log Search for steps on using the tool.
- Examine the results—See View Email Log Search result details for a description of the output.
- Analyze the route and delivery states—See Interpret Email Log Search results for recommendations on using search results to investigate delivery issues.
- Examine the post-delivery message state—See Post-delivery message status for a description of the output.
What messages appear in search results?
- Messages sent from 1 hour ago to the past 7 days, or for a date range you specify in the past 30 days.
Note: Search results for messages older than 30 days show only post-delivery message details.
- Post-delivery message details have no time constraints and are always retained.
- Messages to or from any G Suite user in your domains.
- Messages sent to a group in Google Groups and other mailing lists containing your G Suite users.
What search criteria can I use?
- A specific date and time range.
Note: When you search for messages older than 30 days, message ID and recipient address are required fields.
- A particular envelope sender or recipient—enter a full or partial email address, or just the domain (for example, company.com).
- A particular sender or recipient IP address.
- A specific message ID.