# How do you use Email Log Search in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-email-log-search
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Use Email Log Search in the Google Admin console to find missing messages, read delivery and spam statuses, and fix what you find. Limits and tips included.

## Short answer

In the Google Admin console, go to Menu > Reporting > Email Log Search. Pick a predefined search or a custom search by date, sender, recipient, IP, subject or message ID, then click a result for its delivery steps. You can search the past 30 days in full; older messages need the recipient and message ID.

When a user in Google Workspace says an email never arrived, or a customer says yours never reached them, Email Log Search (ELS) is the admin tool that answers it. It shows whether Gmail received the message, which delivery steps it went through, whether it was marked as spam or quarantined, and what happened after delivery. This guide reflects the Admin console at the time of writing (October 2026).

## Where is Email Log Search in the Admin console?

Sign in to the Google Admin console and go to **Menu** > **Reporting** > **Email Log Search** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/support/troubleshooting/find-messages-with-email-log-search)). You need the **Gmail Settings** administrator privilege.

Google lists ELS in Frontline, Business, Enterprise, Education and Nonprofits editions, plus legacy G Suite Basic and Business. It isn't available to resellers who manage a customer's subscription.

Two limits shape every search:

- **No message content.** Google says "You can't view message contents using ELS." For content, Google points to content compliance rules, Gmail delegation and Google Vault.
- **Organization only.** ELS covers mail "sent and received by people in your organization." You can't trace a message between two outside parties.

## How do you search for a message?

ELS has two tabs: **Predefined search** and **Custom Search**. Whichever you use last becomes the default next time.

### Predefined searches

| Option | Covers |
|---|---|
| All messages from today | All users, from 12 AM local time today |
| All messages since yesterday | All users, the past 48 hours from 12 AM yesterday |
| All messages in the last 7 days | All users, from 12 AM seven days ago |
| Messages sent from your domain since yesterday | Outgoing mail, past 48 hours |
| Messages received from your domain since yesterday | Incoming mail to your users, past 48 hours |

These are useful for spotting a pattern, such as nothing arriving from the internet since a DNS change. For one missing message, a custom search is faster.

### Custom search, step by step

1. Open **Email Log Search** and select the **Custom Search** tab.
2. Choose a **Date** (required): **Today**, **Since yesterday**, **Last 7 days**, **Specify range** (within the past 30 days) or **Older than 30 days**.
3. Enter the **Sender**. Full or partial address, or the Return-Path address. Partial searches need at least 3 characters, and wildcards aren't supported. Put a full address in quotes for an exact match.
4. Enter the **Recipient**, with the same rules. For a Google Group, search by message ID instead.
5. Optionally add **Sender IP**, **Recipient IP** (complete addresses only), **Subject** (not case sensitive) or **Message ID**.
6. Click **Search**.

Google says results come back "within 1 minute to 1 hour, depending on how many messages are in the search results."

### Search tips that save time

- **The message ID beats everything.** Google says that when you search by message ID, "any date range you selected is ignored." Ask the sender or recipient for the `Message-ID` header. Our guide on [how to read email headers](https://iblockspam.com/blog/how-to-read-email-headers) shows where it is.
- **Sender IP isn't always yours.** For outgoing mail, ELS may show a Google outbound IP rather than your office IP, because Gmail sends through Google's servers.
- **Narrow big searches.** One search returns up to 1,000 messages and 15,000 log entries per message. Google says each message typically has 5–7 log entries per recipient, so mail to a large group can hit the limit. Search by recipient alone, or by message ID plus one recipient.
- **Older than 30 days is limited.** You need the recipient's full address and the message ID, you can't search a group address, and only post-delivery status is available.

## How do you read Email Log Search results?

The summary table shows **Subject or Message ID**, **Date** and **Sender** ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/understand-email-log-search-results)). Click the subject to open **Message details**: sender, recipients, message ID, size, attachment count and **Direction** (Sent, Received or Mixed). The **Status** field shows two numbers: how many times the message was delivered, over how many recipients it was sent to. "1 of 3" means two recipients didn't get it.

Click a recipient's address to see **Recipient details**. This is where the answers are:

- **Delivery steps** with a date and time for each, in the time zone of the device you're searching from.
- **Post-delivery message details**, such as labels, read or unread, and whether the user marked it as spam.
- **Matched rules**, if the message triggered a compliance rule, with a link to the rule in the Admin console.

You can export results to Google Sheets or a .csv file. The export is limited to 1,000 messages, includes every delivery step as a separate row, and leaves out post-delivery details.

## What do the delivery statuses mean?

Google defines more than 25 statuses ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/email-log-search-delivery-status-definitions)). These are the ones you'll see most:

| Status | What Google says it means |
|---|---|
| Received from an SMTP server | Arrived from a mail server at the IP shown, with or without TLS |
| Delivered to Gmail inbox | Delivered normally. If it's missing, the user may have deleted, archived or labeled it |
| Delivered to an SMTP server | Delivered to the SMTP server with the address and encryption shown |
| Marked spam | Gmail classified the inbound message as spam |
| Bypassed spam | Marked as spam but delivered normally because of a spam filter setting |
| Quarantined | A setting sent it to admin quarantine |
| Released from quarantine / Rejected from quarantine | An admin released or deleted it |
| Bounced | Account issues such as a blocked IP, sending or receiving limits, or a compliance or routing rule |
| Dropped | Not delivered because the sending server has a bad reputation, or a catch-all or routing rule affected it |
| Rejected | Marked as spam by automatic outbound spam filtering |
| In progress | Still passing through Google's servers |

### Spam classifications

When a step says **Marked spam**, ELS adds a classification. Examples include "The message failed DMARC authentication", "The sender has poor reputation", "The sender is listed in public realtime blacklists", "The message contains one or more suspicious links", "The message was classified based on an administrator-configured spam setting" and "An Advanced Safety Setting was applied to this message."

That tells you which kind of fix to look for, not every signal Gmail used.

## What are the most common findings?

### Delivered, but the user can't find it

**Delivered to Gmail inbox** with no later problem means Gmail did its job. Check the post-delivery status. A label shows where it was filed, and **Spam** means the user marked it as spam themselves. Ask the user to search **All Mail**, including Spam and Trash.

### Marked spam because DMARC failed

This is common with invoices, form notifications and newsletters from small senders. The fix is on the sender's side: their SPF, DKIM and DMARC must pass for the From domain. Our guide on [why DMARC fails](https://iblockspam.com/blog/why-dmarc-fails) covers the usual causes, and you can check the sender's record with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). Avoid an approved senders entry that skips authentication. Our [Gmail spam settings guide](https://iblockspam.com/blog/gmail-spam-settings-google-workspace) explains safer options.

### Quarantined

ELS shows that a setting quarantined the message. Review and release it from admin quarantine, then decide whether the rule that caught it needs tuning.

### Bounced or rejected on the way out

For outgoing mail, a **Bounced** or **Rejected** step usually comes with an error. Look it up in the [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes). If Gmail recipients reject your mail with [550 5.7.26](https://iblockspam.com/smtp-errors/550-5-7-26), your own authentication needs fixing. Google's [About SPF records](https://knowledge.workspace.google.com/admin/security/about-spf-records) page is the reference for the include your domain needs.

### Nothing found

If a custom search by sender and recipient finds nothing in the right window, Gmail probably never accepted the message. Ask the sender for the bounce they received. Then check your MX records with an [MX Lookup](https://iblockspam.com/tools/mx-lookup). If mail passes through an [inbound gateway](https://iblockspam.com/blog/google-workspace-inbound-gateway-setup), the gateway's logs are the next place to look, and **Received from an SMTP server** in ELS should show the gateway's IP for mail that did arrive.

## Is there more detail than Email Log Search?

For investigations rather than single missing messages, use **Gmail log events**. Go to **Menu** > **Reporting** > **Audit and investigation** > **Gmail log events**. That needs the **Audit & Investigation** administrator privilege ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/gmail-log-events)). It records activity such as messages classified as spam, released from quarantine or sent to admin quarantine, with filters you can combine.

On editions whose security investigation tool includes Gmail data (Google lists Enterprise Plus, Frontline Plus and Education Plus for Gmail log events), admins can search the same data under **Security** > **Security center** > **Investigation tool**. From there you can act on the results, for example deleting messages or sending them to quarantine, which is useful after a phishing campaign.

| Tool | Best for | Content visible? |
|---|---|---|
| Email Log Search | One missing or delayed message | No |
| Gmail log events (audit) | Patterns across many messages | No |
| Security investigation tool | Acting on many messages at once | Depends on edition and privileges |
| Google Vault | Retention, legal holds and content search | Yes |

## Next steps

- Make sure at least two admins have the Gmail Settings privilege, so someone can always run ELS.
- When a user reports missing mail, ask for the sender, approximate time and, ideally, the `Message-ID` header before you search.
- Decode any headers you're sent with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser.
- If you filter mail before it reaches Google, check both logs. iBlockSpam keeps 30 days of message history for each domain and gives every user a [quarantine with digests](https://iblockspam.com/features/quarantine-and-digests). See how it fits on our [Google Workspace page](https://iblockspam.com/platforms/google-workspace).
- Microsoft 365 admins have an equivalent tool, covered in [Microsoft 365 message trace](https://iblockspam.com/blog/microsoft-365-message-trace).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### How far back can Email Log Search go?

Full searches cover the past 30 days. For messages older than 30 days, Google requires the recipient's complete address and the message ID, you can't search a Google Group address, and only post-delivery status is shown, not delivery status. For older history or message content, use Google Vault if your edition includes it.

### Who can use Email Log Search?

An admin with the Gmail Settings administrator privilege. Google lists support in Business, Enterprise, Frontline, Education and Nonprofits editions, plus legacy G Suite Basic and Business. Resellers who manage a customer's subscription can't use it. Email Log Search never shows message contents.

### Why does Email Log Search say my search is too wide?

One search returns at most 1,000 messages and 15,000 log entries per message. A message sent to a large group can exceed the log entry limit. Google suggests searching by recipient alone, or by message ID plus one specific recipient, or using a shorter date range.

### What does Dropped mean in Email Log Search?

Google says the message wasn't delivered because the sending server has a bad reputation, based on factors such as spam reports, engagement and bounce rates. The same status appears when a catch-all or routing rule affected the message. Check your routing settings first, then the sender's reputation.

### Can Email Log Search show why Gmail marked a message as spam?

Yes. When a recipient's delivery steps include Marked spam, the details include a spam classification, such as the message failed DMARC authentication, the sender has poor reputation, or an administrator-configured spam setting. It gives the category, not every signal Gmail used.

## Sources

- [Google Workspace Admin Help: Find messages with Email Log Search](https://knowledge.workspace.google.com/admin/support/troubleshooting/find-messages-with-email-log-search)
- [Google Workspace Admin Help: Understand Email Log Search results](https://knowledge.workspace.google.com/admin/gmail/advanced/understand-email-log-search-results)
- [Google Workspace Admin Help: Definitions for message delivery status, post-delivery status, and spam classification](https://knowledge.workspace.google.com/admin/gmail/advanced/email-log-search-delivery-status-definitions)
- [Google Workspace Admin Help: Gmail log events](https://knowledge.workspace.google.com/admin/reports/gmail-log-events)
- [Google Workspace Admin Help: About SPF records](https://knowledge.workspace.google.com/admin/security/about-spf-records)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-email-log-search (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt