Supported editions for this feature: Enterprise; Enterprise for Education. Compare your edition
You can view how many messages were marked as spam by Google’s spam filter during a specific time period. There are 3 versions of the spam filter report:
- All—You can see whether incoming messages are going to user inboxes or being routed as spam.
- Phishing—You can also see how phishing emails are routed.
- Malware—You can see messages marked as malware and when.
View the spam filter report
- Click Security Dashboard.
- Scroll to Spam filter - All, Spam filter - Phishing, and Spam filter - Malware and in the lower-right corner of a card, click View Report.
Interpret the data
Display the spam filter as a graph
If a message is considered suspicious but also has positive qualities—say the sender is whitelisted—it can be placed in a user's inbox. You can see messages that were delivered to a user’s:
- Inbox—Includes suspicious messages that were placed in users’ inboxes due to whitelisting
- Spam folder—Includes messages identified as spam, phishing, or malware by the Gmail spam filter
Tip: You can hide lines in the graph by clicking on the legend. For example, click Spam to hide this line in the graph. This is especially useful if one line overlaps another.
Using the lists above the graph, you can view data from all of your domains or from specific domains. You can also customize the graph to provide details only about certain types of messages:
Pre-delivery—Messages with attachments confirmed to be malware before they are delivered are placed in the user’s spam folder, with the attachments disabled.
|Traffic source||All—Both internal and external messages
External—Sent by users outside of your domain
Internal—Sent by users inside of your domain
|Domain||Choose the domain for your report.|
Customize the report to view data from today, yesterday, this week, last week, this month, last month, or days ago (up to 180 days); or enter a start date and end date. Click Apply after you set the date range.
For this report, data is displayed only for the last 30 days. For example, if you set the parameters for up to 60 days, the data in the report is cut off at 30 days.
To generate a spreadsheet with the graph’s data to Google Drive, click Export Sheet.
Focus on data points in the table
You can also see more details about the number of spam messages that were sent to your domain by clicking a data point in the graph. Details appear in the table below the graph.
You can also generate data by other criteria, including:
- User ID
- Link Domain
- SPF Domain
- DKIM Domain
- Sender Domain
- SHA 256 Attachment Hash
- Attachment File Extension
- Message Size Range
To see the complete set of data point options, scroll left or right on the tabs.
Note: Long and unreadable attachment file names are truncated in spam filter tables.
Compare current and historical data
To compare the current data to historical data, in the top right, from the Statistical analysis menu, select Percentile. You’ll see an overlay on the chart to show the 10th, 50th, and 90th percentile of historical data (180 days for most data and 30 days for Gmail data). Then, to change the analysis, at the top right of the chart, use the menu to change the overlay line.