All help articles

Message trace

Team owners and admins can see how any message to their mailboxes, or sent by their people, went through the mail server: every check it met, what it decided and why, and where the message ended up. It is the quickest way to answer "why is this in Junk?" or "why did they say we refused their mail?".

Open the domain admin panel and choose Message trace.

Finding a message

Search by:

• the sender's or a recipient's address;
• words in the subject;
• the Message-ID (from More → Source and headers in webmail);
• the sender's IP address;
• the message's id in the mail log.

Narrow the list to incoming or outgoing mail, to a verdict (delivered, junk, refused, deferred, queued for other servers, or mixed), or to messages with a spam score of at least some number.

Reading a trace

A trace lists the steps in order. For mail from outside:

1. Connection: the server that sent it, and whether it used TLS.
2. Greylisting: whether the sender had to retry (for a domain that greylists only suspicious mail, after the spam scan).
3. SPF, DKIM, DMARC: whether the message is really from who it says. A failure here is a common reason for Junk; see SPF, DKIM and DMARC.
4. Trusted forwarder: when a trusted forwarder let a forwarded message through.
5. Virus scan: whether it was scanned for viruses, and what was found; for a mailbox that is not scanned, whose choice that is. See Virus scanning.
6. Spam scan: the spam score and each rule that added or took away points, with what it means and what matched (a listed link, the Bayes probability, and so on).
7. Spam decision: for each of your recipients, what happened and why: the score against their junk and refuse scores, or an allowed or blocked sender. See Spam and Junk.
8. Filters and Delivery: what their filters did and the folder it went to.

For mail your people send: the sender check (the address is theirs), the sending limits, DKIM signing and the queue. Below the steps are the message's lines from the mail log, which show each delivery to the other server and any retries.

A message refused for being spam still has a trace, with the answer the sender got, even though nobody has a copy.

Allowing, blocking or refusing the sender

An incoming message's page has a Sender card. For all your team's mailboxes at once:

• Allow sender, or allow its whole domain: its mail is never filed in Junk or refused as spam (viruses still are).
• Block sender, or block its domain: its mail always goes to Junk.
• Refuse its domain: its mail is refused, and the sender is told it was not delivered. See Domain blocking.
• Take off the lists and Stop refusing undo them.
• Trust for greylisting: the server that sent it, or its whole network, is never greylisted again for your mailboxes (spam scoring, virus scanning and DMARC still apply). The card says when it is already trusted, and Stop trusting takes it off. See Greylisting.

When the From address and the envelope sender differ (mailing services often send with their own), choose which one to act on.

An allowed sender only counts when the message proves it is from them (SPF, DKIM or DMARC). Someone forging an allowed address gets no pass: their mail is filtered as usual, and the trace's Spam decision says so. The same lists are on the Spam card, where you can edit them by hand; see Spam and Junk.

Other buttons

Above the trace: Copy link, Copy as text (to paste in a support ticket), Download, searches for more mail from the same sender, domain or IP address or with the same Message-ID, and the message's Mail log lines. The search list can be narrowed to the last hour, day, week or month, and Download CSV saves the messages listed. Searching for a domain finds mail from any address on it.

What you can see

You see only your own team's recipients. When a message went to people in other teams too, their addresses and their steps are left out, and a search for an address outside your team finds nothing. For mail your own people sent, you see every recipient.

Traces are kept for as long as your provider keeps the mail log, usually 30 days. Messages refused before they were sent in full (to an address that does not exist, for example) have no trace.