How do you use Email Log Search in Google Workspace?

When a user in Google Workspace says an email never arrived, or a customer says yours never reached them, Email Log Search (ELS) is the admin tool that answers it. It shows whether Gmail received the message, which delivery steps it went through, whether it was marked as spam or quarantined, and what happened after delivery. This guide reflects the Admin console at the time of writing (October 2026).

Where is Email Log Search in the Admin console?

Sign in to the Google Admin console and go to Menu > Reporting > Email Log Search (Google Workspace Admin Help). You need the Gmail Settings administrator privilege.

Google lists ELS in Frontline, Business, Enterprise, Education and Nonprofits editions, plus legacy G Suite Basic and Business. It isn't available to resellers who manage a customer's subscription.

Two limits shape every search:

• No message content. Google says "You can't view message contents using ELS." For content, Google points to content compliance rules, Gmail delegation and Google Vault.
• Organization only. ELS covers mail "sent and received by people in your organization." You can't trace a message between two outside parties.

How do you search for a message?

ELS has two tabs: Predefined search and Custom Search. Whichever you use last becomes the default next time.

Predefined searches

These are useful for spotting a pattern, such as nothing arriving from the internet since a DNS change. For one missing message, a custom search is faster.

Custom search, step by step

1. Open Email Log Search and select the Custom Search tab.
2. Choose a Date (required): Today, Since yesterday, Last 7 days, Specify range (within the past 30 days) or Older than 30 days.
3. Enter the Sender. Full or partial address, or the Return-Path address. Partial searches need at least 3 characters, and wildcards aren't supported. Put a full address in quotes for an exact match.
4. Enter the Recipient, with the same rules. For a Google Group, search by message ID instead.
5. Optionally add Sender IP, Recipient IP (complete addresses only), Subject (not case sensitive) or Message ID.
6. Click Search.

Google says results come back "within 1 minute to 1 hour, depending on how many messages are in the search results."

Search tips that save time

• The message ID beats everything. Google says that when you search by message ID, "any date range you selected is ignored." Ask the sender or recipient for the Message-ID header. Our guide on how to read email headers shows where it is.
• Sender IP isn't always yours. For outgoing mail, ELS may show a Google outbound IP rather than your office IP, because Gmail sends through Google's servers.
• Narrow big searches. One search returns up to 1,000 messages and 15,000 log entries per message. Google says each message typically has 5–7 log entries per recipient, so mail to a large group can hit the limit. Search by recipient alone, or by message ID plus one recipient.
• Older than 30 days is limited. You need the recipient's full address and the message ID, you can't search a group address, and only post-delivery status is available.

How do you read Email Log Search results?

The summary table shows Subject or Message ID, Date and Sender (Google Workspace Admin Help). Click the subject to open Message details: sender, recipients, message ID, size, attachment count and Direction (Sent, Received or Mixed). The Status field shows two numbers: how many times the message was delivered, over how many recipients it was sent to. "1 of 3" means two recipients didn't get it.

Click a recipient's address to see Recipient details. This is where the answers are:

• Delivery steps with a date and time for each, in the time zone of the device you're searching from.
• Post-delivery message details, such as labels, read or unread, and whether the user marked it as spam.
• Matched rules, if the message triggered a compliance rule, with a link to the rule in the Admin console.

You can export results to Google Sheets or a .csv file. The export is limited to 1,000 messages, includes every delivery step as a separate row, and leaves out post-delivery details.

What do the delivery statuses mean?

Google defines more than 25 statuses (Google Workspace Admin Help). These are the ones you'll see most:

Spam classifications

When a step says Marked spam, ELS adds a classification. Examples include "The message failed DMARC authentication", "The sender has poor reputation", "The sender is listed in public realtime blacklists", "The message contains one or more suspicious links", "The message was classified based on an administrator-configured spam setting" and "An Advanced Safety Setting was applied to this message."

That tells you which kind of fix to look for, not every signal Gmail used.

What are the most common findings?

Delivered, but the user can't find it

Delivered to Gmail inbox with no later problem means Gmail did its job. Check the post-delivery status. A label shows where it was filed, and Spam means the user marked it as spam themselves. Ask the user to search All Mail, including Spam and Trash.

Marked spam because DMARC failed

This is common with invoices, form notifications and newsletters from small senders. The fix is on the sender's side: their SPF, DKIM and DMARC must pass for the From domain. Our guide on why DMARC fails covers the usual causes, and you can check the sender's record with the DMARC Checker. Avoid an approved senders entry that skips authentication. Our Gmail spam settings guide explains safer options.

Quarantined

ELS shows that a setting quarantined the message. Review and release it from admin quarantine, then decide whether the rule that caught it needs tuning.

Bounced or rejected on the way out

For outgoing mail, a Bounced or Rejected step usually comes with an error. Look it up in the SMTP Error Code Lookup. If Gmail recipients reject your mail with 550 5.7.26, your own authentication needs fixing. Google's About SPF records page is the reference for the include your domain needs.

Nothing found

If a custom search by sender and recipient finds nothing in the right window, Gmail probably never accepted the message. Ask the sender for the bounce they received. Then check your MX records with an MX Lookup. If mail passes through an inbound gateway, the gateway's logs are the next place to look, and Received from an SMTP server in ELS should show the gateway's IP for mail that did arrive.

Is there more detail than Email Log Search?

For investigations rather than single missing messages, use Gmail log events. Go to Menu > Reporting > Audit and investigation > Gmail log events. That needs the Audit & Investigation administrator privilege (Google Workspace Admin Help). It records activity such as messages classified as spam, released from quarantine or sent to admin quarantine, with filters you can combine.

On editions whose security investigation tool includes Gmail data (Google lists Enterprise Plus, Frontline Plus and Education Plus for Gmail log events), admins can search the same data under Security > Security center > Investigation tool. From there you can act on the results, for example deleting messages or sending them to quarantine, which is useful after a phishing campaign.

Next steps

• Make sure at least two admins have the Gmail Settings privilege, so someone can always run ELS.
• When a user reports missing mail, ask for the sender, approximate time and, ideally, the Message-ID header before you search.
• Decode any headers you're sent with the Email Header Analyzer, which runs in your browser.
• If you filter mail before it reaches Google, check both logs. iBlockSpam keeps 30 days of message history for each domain and gives every user a quarantine with digests. See how it fits on our Google Workspace page.
• Microsoft 365 admins have an equivalent tool, covered in Microsoft 365 message trace.

Browse more guides on running email day to day.