Spam filter report

Analyze email traffic

Supported editions for this feature: Enterprise; Enterprise for Education.  Compare your edition

You can view how many messages were marked as spam by Google’s spam filter during a specific time period. There are 3 versions of the spam filter report:

  • All—You can see whether incoming messages are going to user inboxes or being routed as spam.
  • Phishing—You can also see how phishing emails are routed.
  • Malware—You can see messages marked as malware and when.

View the spam filter report

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in

  2. Click Security  Dashboard.
  3. Scroll to Spam filter - All, Spam filter - Phishing, and Spam filter - Malware and in the lower-right corner of a card, click View Report.

Interpret the data

Display the spam filter as a graph

If a message is considered suspicious but also has positive qualities—say the sender is whitelisted—it can be placed in a user's inbox. You can see messages that were delivered to a user’s:

  • Inbox—Includes suspicious messages that were placed in users’ inboxes due to whitelisting
  • Spam folder—Includes messages identified as spam, phishing, or malware by the Gmail spam filter

Tip: You can hide lines in the graph by clicking on the legend. For example, click Spam to hide this line in the graph. This is especially useful if one line overlaps another.

Using the lists above the graph, you can view data from all of your domains or from specific domains. You can also customize the graph to provide details only about certain types of messages:

Filter Description
Time classified

Pre-delivery—Messages with attachments confirmed to be malware before they are delivered are placed in the user’s spam folder, with the attachments disabled.

Post-delivery—Messages with attachments that pass initial malware checks are placed in the user’s inbox, but might be identified as malware after the fact by longer-running malware scans. Attachments are disabled once they are classified as malware.

Traffic source All—Both internal and external messages
External—Sent by users outside of your domain
Internal—Sent by users inside of your domain


All—All messages
Clean—Marked as clean
Spam—Marked as spam
Malware--Marked as malware
Phishing—Marked as phishing
Suspicious—Marked as suspicious

Domain Choose the domain for your report.
Date range

Customize the report to view data from today, yesterday, this week, last week, this month, last month, or days ago (up to 180 days); or enter a start date and end date. Click Apply after you set the date range.

For this report, data is displayed only for the last 30 days. For example, if you set the parameters for up to 60 days, the data in the report is cut off at 30 days.


To generate a spreadsheet with the graph’s data to Google Drive, click Export Sheet

Focus on data points in the table

You can also see more details about the number of spam messages that were sent to your domain by clicking a data point in the graph. Details appear in the table below the graph. 

You can also generate data by other criteria, including:

  • Subject 
  • User ID 
  • Link Domain 
  • SPF Domain 
  • DKIM Domain 
  • Sender Domain 
  • SHA 256 Attachment Hash
  • Attachment File Extension
  • Message Size Range

To see the complete set of data point options, scroll left or right on the tabs. 

Note: Long and unreadable attachment file names are truncated in spam filter tables.

Compare current and historical data

To compare the current data to historical data, in the top right, from the Statistical analysis menu, select Percentile. You’ll see an overlay on the chart to show the 10th, 50th, and 90th percentile of historical data (180 days for most data and 30 days for Gmail data). Then, to change the analysis, at the top right of the chart, use the menu to change the overlay line.

Related topics

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue