Spam filter report

Security dashboard

Supported editions for this feature: Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus. Compare your edition

You can see how many messages Google’s spam filter marked as spam during a specific time period by viewing the spam filter report in the security dashboard. There are 3 versions of the spam filter report:

  • All—You can see whether incoming messages are going to user inboxes or being routed as spam.
  • Phishing—You can also see how phishing emails are routed.
  • Malware—You can see messages marked as malware and when.

View the spam filter report

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. In the Admin console, go to Menu and then Securityand thenSecurity centerand thenDashboard.
  3. Scroll to Spam filter - All, Spam filter - Phishing, and Spam filter - Malware and in the lower-right corner of a card, click View Report.

Interpret the data

Display the spam filter as a graph

If a message is considered suspicious but also has positive qualities—say the sender is on your allowlist—it can be placed in a user's inbox. You can see messages that were delivered to a user’s:

  • Inbox—Includes suspicious messages that were placed in users’ inboxes because the sender is on your allowlist
  • Spam folder—Includes messages identified as spam, phishing, or malware by the Gmail spam filter

Tip: You can hide lines in the graph by clicking on the legend. For example, click Spam to hide this line in the graph. This is especially useful if one line overlaps another.

Using the lists above the graph, you can view data from all of your domains or from specific domains. You can also customize the graph to provide details only about certain types of messages:

Filter Description
Time classified

Pre-delivery—Messages with attachments confirmed to be malware before they are delivered are placed in the user’s spam folder, with the attachments disabled.

Post-delivery—Messages with attachments that pass initial malware checks are placed in the user’s inbox, but might be identified as malware after the fact by longer-running malware scans. Attachments are disabled once they are classified as malware.

Traffic source All—Both internal and external messages
External—Sent by users outside of your domain
Internal—Sent by users inside of your domain

Classification
 

All—All messages
Clean—Marked as clean
Spam—Marked as spam
Malware--Marked as malware
Phishing—Marked as phishing
Suspicious—Marked as suspicious

Domain Choose the domain for your report.
Date range

Customize the report to view data from today, yesterday, this week, last week, this month, last month, or days ago (up to 180 days); or enter a start date and end date. Click Apply after you set the date range.

For this report, data is displayed only for the last 30 days. For example, if you set the parameters for up to 60 days, the data in the report is cut off at 30 days.

 

To generate a spreadsheet with the graph’s data to Google Drive, click Export Sheet

Focus on data points in the table

To get more detailed information about spam messages sent on a particular day, click the point on the graph for that date. Details about those messages appear in the table below the graph. 

Click a tab above the table to see more data on the selected messages, including:

  • Subject 
  • Recipient
  • Sender 
  • IP Address
  • Spam classification reason
  • Sender Domain 
  • SPF and DKIM Domains
  • SHA 256 Attachment Hash
  • Attachment File Extension
  • Display Name of sender

To see all the available message data, scroll left or right on the tabs. 

Note: Long and unreadable attachment file names are truncated in spam filter tables.

Compare current and historical data

To compare the current data to historical data, in the top right, from the Statistical analysis menu, select Percentile (not available for all Security dashboard charts). You’ll see an overlay on the chart to show the 10th, 50th, and 90th percentile of historical data (180 days for most data and 30 days for Gmail data). Then, to change the analysis, at the top right of the chart, use the menu to change the overlay line.

Related topics

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu