All help articles

Message trace

Team owners and admins can see how any message to their mailboxes, or sent by their people, went through the mail server: every check it met, what it decided and why, and where the message ended up. It is the quickest way to answer "why is this in Junk?" or "why did they say we refused their mail?".

Open the domain admin panel and choose Message trace.

Finding a message

Search by:

• the sender's or a recipient's address;
• words in the subject;
• the Message-ID (from More → Source and headers in webmail);
• the sender's IP address;
• the message's id in the mail log.

Narrow the list to incoming or outgoing mail, to a verdict (delivered, junk, refused, deferred, queued for other servers, or mixed), or to messages with a spam score of at least some number.

Reading a trace

A trace lists the steps in order. For mail from outside:

1. Connection: the server that sent it, and whether it used TLS.
2. Greylisting: whether the sender had to retry.
3. SPF, DKIM, DMARC: whether the message is really from who it says. A failure here is a common reason for Junk; see SPF, DKIM and DMARC.
4. Trusted forwarder: when a trusted forwarder let a forwarded message through.
5. Spam scan: the spam score and each rule that added or took away points, with what it means and what matched (a listed link, the Bayes probability, and so on).
6. Spam decision: for each of your recipients, what happened and why: the score against their junk and refuse scores, or an allowed or blocked sender. See Spam and Junk.
7. Filters and Delivery: what their filters did and the folder it went to.

For mail your people send: the sender check (the address is theirs), the sending limits, DKIM signing and the queue. Below the steps are the message's lines from the mail log, which show each delivery to the other server and any retries.

A message refused for being spam still has a trace, with the answer the sender got, even though nobody has a copy.

What you can see

You see only your own team's recipients. When a message went to people in other teams too, their addresses and their steps are left out, and a search for an address outside your team finds nothing. For mail your own people sent, you see every recipient.

Traces are kept for as long as your provider keeps the mail log, usually 30 days. Messages refused before they were sent in full (to an address that does not exist, for example) have no trace.