How to Use Email Log Search in Google Workspace

When a message does not arrive — or when a sender insists they sent something and the recipient insists they never got it — someone in IT ends up with a support ticket, two conflicting stories, and no evidence. Email Log Search is the tool in the Google Workspace Admin console that settles those disputes. It shows exactly what happened to every message that touched your domain: whether Google delivered it, rejected it at the gateway, quarantined it as spam, or handed it to another server. This guide explains how to use email log search in Google Workspace, what each status means, how far back the logs go, and what to do when a search comes back empty.

The short answer#

Open the Admin console, go to Reporting, then Email, then Email Log Search. Enter what you know — sender address, recipient address, subject line, date range, or Message-ID — and run the search. The results table shows the delivery status of every matching message. Expand any row to see the full routing path, each hop the message took, the final status, and the reason code if delivery failed.

• Email Log Search lives at Admin console > Reporting > Email > Email Log Search.
• You need Super Admin access or a delegated admin role that includes Reporting privileges.
• The default search window is the last 30 days. Searches further back require Google Vault with a matching retention policy.
• Status values include Delivered, Rejected, Spam, Not Delivered, Encrypted, and Expanded.
• A Message-ID search is the fastest path to one specific message when you already have the ID from the sender's mail headers.

Before you start#

Email Log Search is an admin-only tool. You need a Super Admin account or a delegated admin role that explicitly includes Reports privileges — a role with only User Management access will not see the Reporting menu. If you cannot reach Reporting in the Admin console, ask your Super Admin to grant delegated access with the Reports privilege.

Gather what you know before opening the tool. The more specific the search criteria, the faster the result. At minimum, you need one of: the sender's full email address, the recipient's full email address, or the subject line. If the sender has already checked their sent mail, ask them to open the message, view the full headers, and copy the Message-ID header — a string that looks like a unique identifier inside angle brackets followed by the sending domain. Pasting that into the Message-ID field returns exactly one result and skips all filtering.

The retention window is 30 days by default. If the message was sent more than 30 days ago, Email Log Search will return nothing. To search further back, you need Google Vault configured with a retention rule that covers the relevant mailbox and date range. Without Vault, messages older than 30 days are outside the tool's reach.

How to search email logs in Google Workspace#

The steps below trace a message from the moment it left the sending server to the final delivery event. Work through them in order — later steps assume you have already narrowed the result set.

1. 1

   Sign in to the Admin console

   Go to admin.google.com and sign in with your Super Admin or delegated admin account. If you land in a standard Gmail inbox rather than the Admin console, you are signed in to a regular user account. Switch accounts or use a separate browser profile for the admin session.

2. 2

   Navigate to Reporting > Email > Email Log Search

   In the left sidebar, click Reporting. If you see a condensed navigation menu, expand it. Inside Reporting, choose Email, then Email Log Search. The tool opens a search form with separate fields for sender, recipient, subject, date range, and Message-ID.

3. 3

   Enter your search criteria

   Fill in the fields you have. For a missing-message trace, enter the recipient address and a date range covering when the sender claims to have sent it. For a specific message, paste the Message-ID. Leave fields blank if you are uncertain — partial matches on subject lines work, but they return more rows to sort through. More specific is always faster.

4. 4

   Set the date range

   The date range defaults to the last 24 hours. Widen it to cover the full period in question, up to a maximum of 30 days per search. If you are unsure exactly when the message was sent, expand the range to be safe — the tool handles wide ranges quickly.

5. 5

   Run the search and read the status column

   Click Search. The results table shows one row per matching message-recipient pair. The Status column is the first thing to read: Delivered means Google placed it in the recipient's inbox or handed it to their mail server; Rejected means Google refused it at the gateway; Spam means it was accepted but quarantined; Not Delivered means Google accepted it from the sender but could not complete delivery after retries.

6. 6

   Expand a row for the full routing detail

   Click any row to expand it. The detail pane shows every routing event: receipt timestamp, sending IP, SPF and DKIM results, which routing rule or compliance policy touched the message, and the final disposition. For a rejected or undelivered message, the reason code here tells you exactly what failed — a policy match, an authentication failure, a recipient not found in the directory, or a content compliance rule.

What each status means#

The status column uses terms that are precise in the Email Log Search context but do not always match what users mean when they say a message bounced or was delivered. The table below maps each value to its meaning and the most common causes.

Email Log Search by Google Workspace edition#

Email Log Search is available on every paid Google Workspace edition, but the retention window and whether Google Vault is included vary by plan. The table below summarises what each tier provides as of August 2026 — verify current details on the Google Workspace pricing page, as packaging changes.

What to do when Email Log Search does not work#

Empty results and ambiguous statuses are the two most common failure modes. Each has a specific cause and a specific fix.

A faster way to stay ahead of delivery problems#

Email Log Search answers the question after something has already gone wrong. It does not surface the pattern — that a specific client domain is consistently rejecting your team's messages, that a reply thread has gone quiet because a routing rule intercepted it, or that a thread has stalled waiting for a follow-up that nobody sent.

We build AI Emaily, an AI-native email client that connects to Google Workspace, Gmail, Outlook, and IMAP mailboxes. For teams that lose time to did-you-get-my-email back-and-forth, AI Emaily's rules layer and living brief flag when a thread has gone cold — so the follow-up gets sent before it becomes a support ticket, rather than after. It does not replace Admin console tools; it sits in the workflow where the inbox is actually managed. AI Emaily is available on a 7-day free trial — see current plans at aiemaily.com/pricing.