Interpret Email Log Search results

The email log shows the delivery status for sent and received emails in your G Suite domain. For emails that didn't reach their ultimate destination, the status tells you why. For example, emails may have been quarantined as spam, or bounced because they couldn't be delivered.

The delivery status history appears in the message details area for a particular message. Delivery statuses are explained below.

Delivery statuses

Archived

This message is part of a Google Groups discussion with archiving turned on. Message is viewable on the group’s page.

Accepted for archiving

The message has been accepted for archiving by Google Groups.

Bypassed spam

The message was marked as spam but approved by a spam filter setting.

Bounced

The message bounced because of issues with your account. Some issues might be: your IP address appears on blacklists, your account reached the send limits, or a message violates a compliance or routing policy rule. For more help, see Email bounces because your IP address is blacklisted, Message bounced due to sending limit, and Message bounced due to a policy rule.

Delivered

The message was successfully delivered to the recipient’s Gmail inbox or third-party SMTP server. You can verify which one in the Message details section. If the message is missing, note the IP address that the mail was delivered to, if available. Then, examine the external network for issues. Whether the message went to Gmail or a separate SMTP server is noted on the Message details view.

Delivered to a Google internal server

The message is being delivered within Google's internal network.

Delivered to an SMTP server

The message was delivered to the SMTP server with the specified email address and encryption.

Delivered to Gmail inbox

The message was delivered to the recipient. No further action should be needed. If the message is missing, the user might have deleted it, archived it, or moved it to a label. To search all mailboxes and labels, type this in the search box: in:anywhere <search terms>. See Advanced search for other ways to search email.

Delivered to group for distribution to members

The message was delivered to a group address for expansion to individual group members.

Dropped

The message was not delivered because the sending SMTP server has a bad reputation. For example, the server's IP address might be on a DNS Blackhole List (DNSBL). DNSBL IP addresses (or address ranges) are associated with spam. See Email bounces because your IP address is blacklisted.

Forwarded from group

The message was sent to the recipient following a group expansion.

In progress

The message is passing through Google’s servers and on the way to its destination.

Inserted into Gmail delivery pipeline

The Google SMTP server got the message and put it into the Gmail delivery pipeline for delivery to Gmail accounts.

Inserted into Gmail delivery pipeline by the comprehensive mail storage service

This domain has turned on comprehensive mail storage. This feature stores a copy of all sent or received messages in your domain. The message copies are stored in the associated users' Gmail mailboxes. Stored messages include messages sent or received by non-Gmail mailboxes. Email Log Search shows the entry SYSTEM_OF_RECORD when a message is impacted by this setting.

Marked Spam

The inbound message was classified as unsolicited email (spam) by Gmail. To fix misclassified messages, see Mark or unmark Spam in Gmail.

Messages marked as spam are further classified in one of the following ways:

Spam classification message	What this message means
No spam content was detected in the message.	Gmail did not detect any spam in the message.
The recipient has marked similar messages as spam in the past.	Gmail reported the message as spam because the message recipient reported previous, similar messages as spam.
The message contains suspicious content.	Gmail reported the message as spam because the message has known spam-related content.
The message contains one or more suspicious links.	Gmail reported the message as spam because the body of the message has one or more links that Gmail identified as suspicious.
The message contains one or more suspicious attachments.	Gmail reported the message as spam because the message has an attachment that Gmail identified as suspicious. Suspicious attachments include files that can possibly run a program on the recipient’s device, for example .exe, .msi, and .bat. Attachments that contain macros might also be reported.
The message was classified based on an administrator-configured spam setting.	Gmail reported the message as spam based on custom Gmail policies set for your organization. Learn more at Tailor Gmail settings for your organization.
The message failed DMARC authentication.	Gmail reported the message as spam based on the DMARC policy for the sending domain. Learn more about DMARC.
The sender is listed in public realtime blacklists.	Real-Time Black Lists (RBLs) are lists of IP addresses and domains that have a history of sending spam. Messages received from servers listed in some RBLs are reported as spam by Gmail.
The message violates RFC standards.	Gmail analyzes if messages meet RFC standards for message format. The more a message deviates from RFC standards, the more likely that Gmail reports the message as spam.
The message violates Gmail policy.	Gmail reported the message as spam because it violates one or more G Suite email policies. Learn more about policies for Gmail and G Suite.
The message matches known spamming patterns.	Gmail reported the message as spam because the message contains known spamming patterns.
The sender has poor reputation.	Gmail reported the message as spam because the sender has a poor reputation. Spam reports about the sender domain result in poor reputation for the domain.
The message was blatant spam.	Gmail reported the message as spam because it has one or more characteristics of blatant spam.
An Advanced Safety Setting was applied to this message.	Gmail reported this message as spam because it triggered one or more advanced security settings for your domain. Learn more about Advanced security settings.

Quarantined

The message triggered a setting that resulted in the message being quarantined. You should view the message in Admin Quarantine to decide if the message should be delivered or rejected as non-deliverable.

Received from a Google internal server

The inbound message was originally sent from a G Suite account, possibly your own organization. If this status appears multiple times in the Recipient details, the message likely originated from a G Suite account outside of the recipient domain.

Received from an SMTP server

The inbound message was received from a message transfer agent (MTA) at the IP address shown. This line also shows whether the message was encrypted via Transport Layer Security(TLS). If you're using SSL/TLS IMAP with Microsoft^® Outlook^® and messages are received with TLS, messages are encrypted between the Gmail server and the sending host.

To enable TLS encryption for your own organization, see the Secure transport (TLS) compliance setting .

Rejected

The message is being marked as spam by automatic outbound spam filtering. For help resolving this see Sent message bounces with "Message rejected".

Rejected from quarantine

An administrator examined the message in the quarantine Message Center and deleted it. The most common reason for message deletion is the message is spam. Spam messages should not be delivered to the recipient.

Released from quarantine

An administrator examined the message in the quarantine Message Center and decided it was not spam. The administrator removed the message from quarantine so it could be delivered to the recipient.

Sent for archiving

The message was sent for Google Groups archiving.

Sent for moderation

This message is part of a Google Groups discussion. The message was sent to the moderation queue for review by the group moderators.

Sent from Gmail

The message was sent from Gmail.

Sent to group members

The message was sent to the individual group members.

Post-delivery message status

Label

A comma-separated list of non-Inbox labels is assigned to the message.

Marked important

The message is marked important.

Marked unimportant

The message is marked unimportant.

Opened and marked unread

The message was opened and viewed, but is marked unread.

Opened and read

The message was opened and viewed.

Seen

The message was listed in the user's view when the user opened Gmail.

Spam

The message is marked as spam.

Starred

The message is starred.

Unopened and marked read

The message was never opened and viewed, but is marked read.

Unopened and unread

The message was never opened and never viewed.

Unseen

The message has not yet been loaded in the user view.

Display information on triggered settings

If a message triggers Advanced Gmail settings, you can review this information in the log search result for the message. The triggered setting type and name is displayed under Recipient details > Matched rules. There is link to the settings from the Admin Console.

Details about the content that triggered the rule are shown for certain rule types, such as Content Compliance and Objectionable Content.

Note: Triggered rule details and subject search are not available for G Suite for Government or for customers with location requirements.

Perform an email log search.
On the search results page, click a message subject or message ID to see more details.
In Recipient details, click a recipient email address to expand the delivery history.
In a delivery step, matched rule information appears under Matched rules. The rule type (for example, CONTENT_COMPLIANCE) and rule description are shown.
To link to the settings or to see further information, click the arrow next to the matched rule .
If a content compliance or objectionable content rule was matched, you can get details about what content triggered the rule. Any sensitive information in the content appears redacted.
To inspect or modify the matched setting, click the Go to this setting link. This takes you to the top-level organizational unit where the setting was created. You can change the setting as needed.
Note: If the matched setting has been modified since it was created, the link takes you to the current version of the setting. If the setting has been deleted, no link is available.

More Gmail troubleshooting

Was this helpful?

How can we improve it?