Interpret Email Log Search results

The email log shows the delivery status for sent and received emails in your Google Workspace domain. For emails that didn't reach their ultimate destination, the status tells you why. For example, emails may have been quarantined as spam, or bounced because they couldn't be delivered.

The delivery status history appears in the message details area for a particular message. Delivery statuses are explained below.

Delivery statuses

This message is part of a Google Groups discussion with conversation history turned on. Message is viewable on the group’s page.
Accepted for archiving
The message has been accepted for archiving by Google Groups.
Bypassed spam
The message was marked as spam but approved by a spam filter setting.
The message bounced because of issues with your account. Some issues might be: your IP address appears on blacklists, your account reached the send limits, or a message violates a compliance or routing policy rule. For more help, see Email bounces because your IP address is blacklistedMessage bounced due to sending limit, and Message bounced due to a policy rule
The message was successfully delivered to the recipient’s Gmail inbox or third-party SMTP server. You can verify which one in the Message details section. If the message is missing, note the IP address that the mail was delivered to, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.
Delivered to a Google internal server
The message was generated by a Google service, and was handed off to that service for delivery. This status doesn't indicate whether the message was delivered to the recipient.
Delivered to an SMTP server
The message was delivered to the SMTP server with the specified email address and encryption.
Delivered to Gmail inbox
The message was delivered to the recipient. No further action should be needed. If the message is missing, the user might have deleted it, archived it, or moved it to a label. To search all mailboxes and labels, type this in the search box: in:anywhere <search terms>. See Advanced search for other ways to search email.
Delivered to group for distribution to members
The message was delivered to a group address for expansion to individual group members.
The message was not delivered because the sending SMTP server has a bad reputation. For example, the server's IP address might be on a DNS Blackhole List (DNSBL). DNSBL IP addresses (or address ranges) are associated with spam. See Email bounces because your IP address is blacklisted.

A "Dropped" status can also occur when a message is affected by a catch-all rule or Gmail rerouting rule.
Forwarded from group
The message was sent to the recipient following a group expansion.
In progress
The message is passing through Google’s servers and on the way to its destination.
Inserted into Gmail delivery pipeline
The Google SMTP server got the message and put it into the Gmail delivery pipeline for delivery to Gmail accounts.​
Inserted into Gmail delivery pipeline by the comprehensive mail storage service
This domain has turned on comprehensive mail storage. This feature stores a copy of all sent or received messages in your domain. The message copies are stored in the associated users' Gmail mailboxes. Stored messages include messages sent or received by non-Gmail mailboxes. Email Log Search shows the entry SYSTEM_OF_RECORD when a message is impacted by this setting.
Marked Spam

The inbound message was classified as unsolicited email (spam) by Gmail. To fix misclassified messages, see Mark or unmark Spam in Gmail

Messages marked as spam are further classified in one of the following ways:


Spam classification message

What this message means

No spam content was detected in the message.

Gmail did not detect any spam in the  message.

The recipient has marked similar messages as spam in the past.

Gmail reported the message as spam because the message recipient reported previous, similar messages as spam.

The message contains suspicious content.

Gmail reported the message as spam because the message has known spam-related content.

The message contains one or more suspicious links.

Gmail reported the message as spam because the body of the message has one or more links that Gmail identified as suspicious.

The message contains one or more suspicious attachments.

Gmail reported the message as spam because the message has an attachment that Gmail identified as suspicious. Suspicious attachments include files that can possibly run a program on the recipient’s device, for example .exe, .msi, and .bat. Attachments that contain macros might also be reported.

The message was classified based on an administrator-configured spam setting.

Gmail reported the message as spam based on custom Gmail policies set for your organization. Learn more at Tailor Gmail settings for your organization.

The message failed DMARC authentication.

Gmail reported the message as spam based on the DMARC policy for the sending domain. Learn more about DMARC.

The sender is listed in public realtime blacklists.

Real-Time Black Lists (RBLs) are lists of IP addresses and domains that have a history of sending spam. Messages received from servers listed in some RBLs are reported as spam by Gmail.

The message violates RFC standards.

Gmail analyzes if messages meet RFC standards for message format. The more a message deviates from RFC standards, the more likely that Gmail reports the message as spam.

The message violates Gmail policy.

Gmail reported the message as spam because it violates one or more Google Workspace email policies. Learn more about policies for Gmail and ​Google Workspace​.

The message matches known spamming patterns.

Gmail reported the message as spam because the message contains known spamming patterns.

The sender has poor reputation.

Gmail reported the message as spam because the sender has a poor reputation. Spam reports about the sender domain result in poor reputation for the domain.

The message was blatant spam.

Gmail reported the message as spam because it has one or more characteristics of blatant spam.

An Advanced Safety Setting was applied to this message.

Gmail reported this message as spam because it triggered one or more advanced security settings for your domain. Learn more about Advanced security settings.

Missed upload deadline
This error indicates that the message recipient's SMTP server didn't respond to the Gmail SMTP server's "DATA" payload in a timely manner. This issue should be addressed by the recipient's postmaster or domain administrator.
The message triggered a setting that resulted in the message being quarantined. You should view the message in Admin Quarantine to decide if the message should be delivered or rejected as non-deliverable.
Received from a Google internal server
The inbound message was originally sent from a Google Workspace account, possibly your own organization. If this status appears multiple times in the Recipient details, the message likely originated from a Google Workspace account outside of the recipient domain.
Received from an SMTP server
The inbound message was received from a message transfer agent (MTA) at the IP address shown. This line also shows whether the message was encrypted via Transport Layer Security(TLS). If you're using SSL/TLS IMAP with Microsoft Outlook and messages are received with TLS, messages are encrypted between the Gmail server and the sending host.

To enable TLS encryption for your own organization, see the Secure transport (TLS) compliance setting .
The message is being marked as spam by automatic outbound spam filtering. For help resolving this see Sent message bounces with "Message rejected".
Rejected from quarantine
An administrator examined the message in the quarantine Message Center and deleted it. The most common reason for message deletion is the message is spam. Spam messages should not be delivered to the recipient. 
Released from quarantine
An administrator examined the message in the quarantine Message Center and decided it was not spam. The administrator removed the message from quarantine so it could be delivered to the recipient.
Sent for archiving
The message was sent for Google Groups archiving.
Sent for moderation
This message is part of a Google Groups discussion. The message was sent to the moderation queue for review by the group moderators.
Sent from Gmail
The message was sent from Gmail.
Sent to group members
The message was sent to the individual group members.

Post-delivery message status

A comma-separated list of non-Inbox labels is assigned to the message.
Marked important
The message is marked important.
Marked unimportant
The message is marked unimportant.
Opened and marked unread
The message was opened and viewed, but is marked unread.
Opened and read
The message was opened and viewed.
The message was listed in the user's view when the user opened Gmail.
The message is marked as spam.
The message is starred.
Unopened and marked read
The message was never opened and viewed, but is marked read.
Unopened and unread
The message was never opened and never viewed.
The message has not yet been loaded in the user view.

Display information on triggered settings

If a message triggers Advanced Gmail settings, you can review this information in the log search result for the message. The triggered setting type and name is displayed under Recipient details > Matched rules. There is link to the settings from the Admin Console.

Details about the content that triggered the rule are shown for certain rule types, such as Content Compliance and Objectionable Content.

  1. Perform an email log search.
  2. On the search results page, click a message subject or message ID to see more details.
  3. In Recipient details, click a recipient email address to expand the delivery history.

    In a delivery step, matched rule information appears under Matched rules. The rule type (for example, CONTENT_COMPLIANCE) and rule description are shown.

  4. To link to the settings or to see further information, click the arrow next to the matched rule .

    If a content compliance or objectionable content rule was matched, you can get details about what content triggered the rule. Any sensitive information in the content appears redacted.

  5. To inspect or modify the matched setting, click the Go to this setting link. This takes you to the top-level organizational unit where the setting was created. You can change the setting as needed.

    Note: If the matched setting has been modified since it was created, the link takes you to the current version of the setting. If the setting has been deleted, no link is available.

More Gmail troubleshooting

Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Clear search
Close search
Google apps
Main menu
Search Help Center