Email Log Search delivery status definitions

Email Log Search (ELS) search result details include status information for each message in the search results. ELS results include two status types for messages:

• Message delivery status
  • Spam classifications
• Message post-delivery status

ELS message delivery status

Message delivery status is included in detailed ELS results. The delivery status describes the state of the message at a specific step during the message delivery process.

Status	Description
Archived	This message is part of a Google Groups discussion that has conversation history turned on. The message is available on the group page.
Accepted for archiving	The message has been accepted for archiving by Google Groups.
Bypassed spam	The message was marked as spam but was delivered normally to the recipient because of a spam filter setting.
Bounced	The message bounced because of issues with the email account. Issues can include: your IP address is blocked, your account reached sending or receiving limits, or the message violates a compliance or routing policy rule.
Delivered	The message was delivered to the recipient’s Gmail inbox or third-party SMTP server, which is included in the ELS results Message details. If the message is missing, get the IP address where the message was delivered. Then, check your external network for issues.
Delivered to a Google internal server	A Google service generated the message and handed it off to that service for delivery. This status doesn't indicate whether the message was delivered to the recipient.
Delivered to an SMTP server	The message was delivered to the SMTP server with the specified email address and encryption.
Delivered to Gmail inbox	The message was delivered normally to the recipient. If the message is missing, the recipient might have deleted it, archived it, or moved it to a label. The account owner can search all mailboxes and labels, or use Gmail advanced search to try to find the message.
Delivered to group for distribution to members	The message was delivered to a group address for expansion to individual group members.
Dropped	The message wasn’t delivered because the sending server has a bad reputation. Multiple factors can impact server reputation, including spam reports, recipient engagement, and bounce rates. This status is also applied when the message is affected by a Gmail catch-all or routing rule.
Forwarded by group	The message was sent to the recipient following a group expansion.
In progress	The message is passing through Google’s servers on the way to its destination.
Inserted into Gmail delivery pipeline	The Google SMTP server got the message and put it into the Gmail delivery pipeline for delivery to recipients.​
Inserted into Gmail delivery pipeline by the comprehensive mail storage service	The domain uses comprehensive mail storage, which stores a copy of all sent or received messages in your domain. When the storage setting affects a message, ELS shows SYSTEM_OF_RECORD .
Marked spam	The inbound message was classified as spam by Gmail. To fix misclassified messages, visit Mark or unmark Spam in Gmail. Messages marked as spam have a spam classification, described in ELS spam classifications, in this article.
Missed upload deadline	The recipient's SMTP server didn't respond to the Gmail SMTP server's DATA payload in enough time. The recipient’s email administrator should resolve this issue.
Opened	Information about each time the message was opened. Each entry includes: Date and time the message was opened, the IP address of the device where the message was opened, the unique device session identifier, and the Gmail client type, for example web, Android, or iOS.
Quarantined	The message triggered a setting that resulted in the message being quarantined. Review the message in Admin Quarantine to decide if the message should be delivered or rejected.
Received from a Google internal server	The inbound message was originally sent from a Google Workspace account, possibly your own organization. If this status appears multiple times in the Recipient details, the message likely originated from a Google Workspace account outside the recipient’s domain.
Received from an SMTP server	The inbound message was received from a message transfer agent at the IP address shown. This line also shows whether the message was encrypted with TLS. If you use TLS IMAP with Microsoft Outlook, and messages are received with TLS, messages are encrypted between the Gmail server and the sending host. To turn on TLS encryption for your own organization, use the Secure transport (TLS) compliance setting.
Rejected	The message is marked as spam by automatic outbound spam filtering. For help with resolving this issue, visit Email bounces with error message.
Rejected from quarantine	An administrator checked the message in the email quarantine and deleted it. The most common reason for message deletion is that the message is spam.
Released from quarantine	An administrator inspected the message in the email quarantine and determined it was not spam. The administrator removed the message from quarantine so it could be delivered to the recipient.
Sent for archiving	The message was sent for Google Groups archiving.
Sent for moderation	The message is part of a Google Groups discussion. The message was sent to the moderation queue for review by the group moderators.
Sent from Gmail	The message was sent from Gmail.
Sent to group members	The message was sent to the individual group members.

 

ELS spam classifications

If a message has a delivery status of Marked spam, ELS categorizes that message into one of the following spam types:

 

Spam classification	Definition
No spam content was detected in the message.	Gmail didn’t detect any spam in the message.
The recipient has marked similar messages as spam in the past.	Gmail reported the message as spam because the message recipient reported previous, similar messages as spam.
The message contains suspicious content.	Gmail reported the message as spam because the message has known spam-related content.
The message contains one or more suspicious links.	Gmail reported the message as spam because the body of the message has one or more links that Gmail identified as suspicious.
The message contains one or more suspicious attachments.	Gmail reported the message as spam because the message has an attachment that Gmail identified as suspicious. Suspicious attachments include files that might run harmful software on the recipient’s device. File types that might cause this classification include .exe, .msi, and .bat. Messages with attachments that have macros might be classified like this.
The message was classified based on an administrator-configured spam setting.	Gmail reported the message as spam based on custom Gmail policies set for your organization. Learn more at Tailor Gmail settings for your organization.
The message failed DMARC authentication.	Gmail reported the message as spam based on the DMARC policy for the sending domain. Learn more about DMARC.
The sender is listed in public realtime blacklists.	The sender IP addresses or domain is in a public, third-party list of senders that have a history of spam. Gmail marks messages received from servers on these lists as spam.
The message violates RFC standards.	Gmail analyzes if messages meet RFC standards for message format. The more a message deviates from RFC standards, the more likely that Gmail reports the message as spam.
The message violates Gmail policy.	Gmail reported the message as spam because it violates one or more email policies. Learn more about policies for Gmail and ​Google Workspace​.
The message matches known spamming patterns.	Gmail reported the message as spam because the message has known spam patterns.
The sender has poor reputation.	Gmail reported the message as spam because the sender has a poor reputation. Spam reports about the sender domain result in poor reputation for the domain.
The message was blatant spam.	Gmail reported the message as spam because it has one or more characteristics of blatant spam.
An Advanced Safety Setting was applied to this message.	Gmail reported this message as spam because it triggered one or more advanced security settings for your domain. Learn more about Advanced security settings.

 

ELS post-delivery status

Message post-delivery status is the status of the message in the recipient’s mailbox. This status also shows actions taken on the message after it was delivered. A message can have more than one post-delivery status associated with it.

These are the possible post-delivery statuses for messages:

• Label: A list of labels assigned to the message. Doesn’t include the Inbox label.
• Marked important
• Marked unimportant
• Opened and marked unread. 
• Opened and read. 
• Seen: The message was displayed in the user's view in Gmail.
• Spam: The recipient manually marked the message as spam.
• Starred
• Unopened and marked read
• Unopened and unread
• Unseen: The message doesn’t yet appear in the user’s view in Gmail.

Post delivery message details are not available for this recipient

When this alert is displayed, you can't see post delivery status details for messages: Post delivery message details are not available for this recipient

There are several possible causes for this, including:

• Your Google Workspace license or edition doesn't give you access to post-delivery status in ELS.
• The message is from an external email account, a deleted account, or a non-Gmail account.
• The message was sent to one or more Google Groups.

Related information

Understand Email Log Search results

 

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}