Interpret Email Log Search results
The email log shows the delivery status for sent and received emails in your G Suite domain. For emails that didn't reach their ultimate destination, the status tells you why. For example, emails may have been quarantined as spam, or bounced because they couldn't be delivered.
The delivery status history appears in the message details area for a particular message. Delivery statuses are explained below.
Delivery statuses
in:anywhere <search terms>
. See Advanced search for other ways to search email.The inbound message was classified as unsolicited email (spam) by Gmail. To fix misclassified messages, see Mark or unmark Spam in Gmail.
Messages marked as spam are further classified in one of the following ways:
Spam classification message |
What this message means |
No spam content was detected in the message. |
Gmail did not detect any spam in the message. |
The recipient has marked similar messages as spam in the past. |
Gmail reported the message as spam because the message recipient reported previous, similar messages as spam. |
The message contains suspicious content. |
Gmail reported the message as spam because the message has known spam-related content. |
The message contains one or more suspicious links. |
Gmail reported the message as spam because the body of the message has one or more links that Gmail identified as suspicious. |
The message contains one or more suspicious attachments. |
Gmail reported the message as spam because the message has an attachment that Gmail identified as suspicious. Suspicious attachments include files that can possibly run a program on the recipient’s device, for example .exe, .msi, and .bat. Attachments that contain macros might also be reported. |
The message was classified based on an administrator-configured spam setting. |
Gmail reported the message as spam based on custom Gmail policies set for your organization. Learn more at Tailor Gmail settings for your organization. |
The message failed DMARC authentication. |
Gmail reported the message as spam based on the DMARC policy for the sending domain. Learn more about DMARC. |
The sender is listed in public realtime blacklists. |
Real-Time Black Lists (RBLs) are lists of IP addresses and domains that have a history of sending spam. Messages received from servers listed in some RBLs are reported as spam by Gmail. |
The message violates RFC standards. |
Gmail analyzes if messages meet RFC standards for message format. The more a message deviates from RFC standards, the more likely that Gmail reports the message as spam. |
The message violates Gmail policy. |
Gmail reported the message as spam because it violates one or more G Suite email policies. Learn more about policies for Gmail and G Suite. |
The message matches known spamming patterns. |
Gmail reported the message as spam because the message contains known spamming patterns. |
The sender has poor reputation. |
Gmail reported the message as spam because the sender has a poor reputation. Spam reports about the sender domain result in poor reputation for the domain. |
The message was blatant spam. |
Gmail reported the message as spam because it has one or more characteristics of blatant spam. |
An Advanced Safety Setting was applied to this message. |
Gmail reported this message as spam because it triggered one or more advanced security settings for your domain. Learn more about Advanced security settings. |
To enable TLS encryption for your own organization, see the Secure transport (TLS) compliance setting .
Post-delivery message status
Display information on triggered settings
If a message triggers Advanced Gmail settings, you can review this information in the log search result for the message. The triggered setting type and name is displayed under Recipient details > Matched rules. There is link to the settings from the Admin Console.
Details about the content that triggered the rule are shown for certain rule types, such as Content Compliance and Objectionable Content.
Note: Triggered rule details and subject search are not available for G Suite for Government or for customers with location requirements.
- Perform an email log search.
- On the search results page, click a message subject or message ID to see more details.
- In Recipient details, click a recipient email address to expand the delivery history.
In a delivery step, matched rule information appears under Matched rules. The rule type (for example, CONTENT_COMPLIANCE) and rule description are shown.
- To link to the settings or to see further information, click the arrow next to the matched rule .
If a content compliance or objectionable content rule was matched, you can get details about what content triggered the rule. Any sensitive information in the content appears redacted.
- To inspect or modify the matched setting, click the Go to this setting link. This takes you to the top-level organizational unit where the setting was created. You can change the setting as needed.
Note: If the matched setting has been modified since it was created, the link takes you to the current version of the setting. If the setting has been deleted, no link is available.