How does an email log search work?


You can sift through the delivery logs for your domains and evaluate message delivery using Email Log Search in the Google Admin console. The reports help you track down missing messages, such as those quarantined as spam or otherwise routed incorrectly. You can also use the tool to determine message IP addresses and troubleshoot how policies affect mail flow.

In addition to tracking the delivery of a message, you can use Email Log Search to investigate the status of a message after it has been delivered to a user's Gmail mailbox. This includes the current assigned labels, message location, and whether or not the message has been deleted.



Search for messages

  1. In your Google Admin console (at admin.google.com)...

  2. Go to Reports > Audit > Email log search.

    Requires having the Email log search administrator privilege.


  3. Select a date range using the drop-down list or specify a range using the calendar. The range is limited to the last 30 days.

    Note: To search for messages older than 30 days, you need to include Recipient and Message ID, the only available search fields. You can’t access message delivery history, only Post-delivery message details.

  4. (Optional) If you specify a date range and also want to specify a time range, enter a different start and end time for the date range. The times shown represent the time zone of the computer you're using to sign in to the Admin console and run the reports.
  5. (Optional) Enter search criteria in any of the following fields:
    • Sender or Recipient—When searching by recipient, enter recipient's complete or partial email address. When searching by sender, enter all or part of the sender's 'Return-Path' address. (You can locate a sender's Return-Path address in the message header of an email from that sender.) If you're searching for an exact match, enter the complete email address and enclose it in quotes, for example, "john@xyz.com".

      Note: When searching for an email sent to a group email address, search by message ID. Searching with the group address as the recipient will not show the delivery to individual group members.

    • Sender IP or Recipient IP—Enter the sender or recipient IP address. Make sure it's the exact IP address, or the request will fail.

      Note: When searching on Sender IP, search results can include messages that show a Google outbound IP rather than the expected public outbound IP for your domain. This is because messages composed using Gmail's web interface are handed off to Gmail servers for delivery, and thus show the Google outbound IP as the sending IP.

    • Subject—(Not available for all accounts) Enter an email subject line, or part of a subject line. The subject line of an email must contain the exact text (case-insensitive) you enter for the message to be returned.
    • Message ID—Enter the unique message identifier located in the message header. If you also specify a date/time range, note that message ID overrides date/time range and will return a message found outside the range.

      See Message headers for instructions on how to find the message ID for different mail providers. 

  6. Click Search. You should see search results within a minute or two (although in some cases the wait may be up to an hour).
    • Search results are limited to 1000 messages.
    • For multi-page results, use the arrows at the top or bottom of the message list to change pages.
    • Click a subject (or message ID) to see message details, including delivery path and status. View Email Log Search result details.

Download search results

To download your search results as a CSV file, or export them to Google Sheets, click Download Download at the top of the page.

  • You'll only see Download if the results return exportable data.
  • The download file for a large number of search results may take longer to create.
  • The CSV file (or spreadsheet) shows the delivery steps for each message in your search results. So expect your CSV file or spreadsheet to have many more lines of data than the actual number of search results.
  • Data in the CSV file (or spreadsheet) is limited to 1000 messages (identical to search result limits).
  • Post-delivery message details are not available in the CSV file.