Interpret Email Log Search results
The Email log shows the delivery status for sent and received emails in your G Suite domain. For emails that didn't reach their ultimate destination, the status will tell you why. For example, emails may have been quarantined as spam, or bounced because they couldn't be delivered.
The delivery status history appears in the message details area for a particular message. Delivery statuses are explained below.
Delivery statuses
Archived
This message is part of a Google Groups discussion with archiving turned on. Message is viewable on the group’s page.
Accepted for archiving
The message has been accepted for archiving by Google Groups.
Bypassed spam
The message was marked as spam but approved by a spam filter setting.
Bounced
The message bounced because of issues with your account, such as your IP address appearing on blacklists, your account hitting sending limits, or a message violating a compliance or routing policy rule. For more help see Email bounces because your IP address is blacklisted, Message bounced due to sending limit, and Message bounced due to a policy rule.
Delivered
The message was successfully delivered to the recipient’s Gmail inbox or third-party SMTP server. You can verify which one in the Message details section. If the message is missing, note the IP address that the mail was delivered to, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.
Delivered to a Google internal server
The message is being delivered within Google's internal network.
Delivered to an SMTP server
The message was delivered to the SMTP server with the specified email address and encryption (or lack thereof).
Delivered to Gmail inbox
The message was delivered to the recipient. No further action should be needed. If the message is missing, the user might have deleted it or moved it out of sight. To search all mailboxes and labels, in the search box type
in:anywhere <search string> query. See Advanced search for other operators.Delivered to group for distribution to members
The message was delivered to a group address for expansion to individual group members.
Dropped
The message was not delivered due to the bad reputation of the sending SMTP server. For example, this server's IP address may be on a DNS Blackhole List (DNSBL). These are IP addresses (or address ranges) associated with spamming activities. See Email bounces because your IP address is blacklisted.
Forwarded from group
The message was sent to the recipient following a group expansion.
In progress
The message is passing through Google’s servers and on the way to its destination.
Inserted into Gmail delivery pipeline
The message was received in the Google SMTP server and was inserted into the Gmail delivery pipeline for delivery to each Gmail account.
Inserted into Gmail delivery pipeline by the comprehensive mail storage service
This domain has turned on comprehensive mail storage. This ensures that a copy of all sent or received messages in your domain is stored in the associated users' Gmail mailboxes. This includes messages sent or received by non-Gmail mailboxes. Email Log Search shows the entry SYSTEM_OF_RECORD if a message is affected by this setting.
Marked Spam
The inbound message was classified as unsolicited email in Gmail. To rectify misclassified messages, see Mark or unmark Spam in Gmail.
Quarantined
The message triggered a setting that resulted in the message being quarantined. An administrator must examine the message in Admin Quarantine to determine whether this message should be released for delivery or rejected as non-deliverable.
Received from a Google internal server
The inbound message was originally sent from a G Suite account, possibly your own organization. If this status appears multiple times in the Recipient details for a message, the message likely originated from a G Suite account outside of the recipient domain.
Received from an SMTP server
The inbound message was received from a message transfer agent (MTA) at the IP address shown. This line also shows whether the message was encrypted via Transport Layer Security(TLS). If you're using SSL/TLS IMAP with Microsoft® Outlook® and messages are received with TLS, the messages are encrypted between the Gmail server and the host that sent it. See the Secure transport (TLS) compliance setting to enable TLS encryption for your own organization.
Rejected
The message is being marked as spam by automatic outbound spam filtering. For help resolving this see Sent message bounces with "Message rejected".
Rejected from quarantine
An administrator examined the message in the quarantine Message Center. After determining that it is spam and should not be delivered to the intended recipient, the administrator deletes the message.
Released from quarantine
An administrator examined the message in the quarantine Message Center. After determining that it is not spam and should be delivered to the intended recipient, the administrator releases the message.
Sent for archiving
The message was sent for Google Groups archiving.
Sent for moderation
This message is part of a Google Groups discussion and has been sent to the moderation queue for review by the group’s moderators.
Sent from Gmail
The message was sent from Gmail.
Sent to group members
The message was sent to the individual group members.
Post-delivery message status
Label
A comma-separated list of non-Inbox labels is assigned to the message.
Marked important
The message is currently marked important.
Marked unimportant
The message is currently marked unimportant.
Opened and marked unread
The message was opened and viewed, but is specifically marked unread.
Opened and read
The message was opened and viewed.
Seen
The message was listed in the user's view when the user accessed Gmail.
Spam
The message is currently marked as spam.
Starred
The message is currently starred.
Unopened and marked read
The message was never opened and viewed, but is specifically marked read.
Unopened and unread
The message was never opened and never viewed.
Unseen
The message is yet to be loaded in the user’s view.
Display information on triggered settings
If a message triggers Advanced Gmail settings—for example, it’s quarantined due to an attachment—you can review this information in the log search result for the message. Under Recipient details > Matched rules, you’ll see the triggered setting type and name, along with a link to the setting itself in the Admin console. For certain rule types (like Content Compliance and Objectionable Content), you’ll also see details about what content caused the rule to trigger.
Note: Triggered rule information and subject search are not available for G Suite for Government editions or for customers with data location requirements.
- Perform an email log search.
- On the search results page, click a message’s subject (or message ID) to see more details.
- In Recipient details, click a recipient email address to expand the delivery history.
Within a delivery step, matched rule information appears under Matched rules. The rule type (for example, CONTENT_COMPLIANCE) and rule description are shown.
- Click the arrow next to the matched rule to access the setting, or to see further information.
If a content compliance or objectionable content rule was matched, you can get details about what content triggered the rule (any sensitive information in the content will appear redacted).
- To inspect or modify the matched setting, click the Go to this setting link. This takes you to the top-level organizational unit where the setting was created, where you can modify the setting as needed.
Note: If the matched setting has been modified since it was created, the link takes you to the current version of the setting. If the setting has been deleted, no link will be available.
