Incoming Log Search

In the Admin or Domain Level Control Panel, search incoming or outgoing logs by selecting Incoming > Logs or Outgoing > Logs

Query Rules Panel

The Query Rules panel allows you to customise your search filters. The default query rule for the Log Search is the Timestamp rule.

Use the shortcuts beneath the Timestamp filter to quickly select results from Yesterday, the Last week and Last month.

1. Click on + New rule and select from the filter options available:



The Query Rules are constructed of three parts:

• The part of the message/metadata you are looking for - Select from the first dropdown in the Query Rules panel
• The type of match e.g. contains, does not start with etc. - Select from the second dropdown in the Query Rules panel
• The content you are trying to match
All query rule possibilities and types

Message Part	Match Type	Content
Message ID	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Message ID to search for
Admin	Child of	Text box; enter the Admin to search for and select from the drop-down
Domain	Equals	Text box; enter the domain to search for and select from the drop-down
Filtering Host	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Filtering Host to search for
Timestamp	On Before After Between Previous Since last run	Date and time selector
Sender	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Sender address to search for
Recipient	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Recipient address to search for
Sender Hostname	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Sender Hostname to search for
Sender IP	Matches Contains Does Not Contain Equals Does Not Equal Starts With Ends With	Text box; enter Sender IP to search for
Sender Location	Is Is Not	Text box; begin typing a country to see a list of pre-populated locations or type: Anonymous Proxy Satellite provider
Bytes Received	Equals Does Not Equal Greater Than Less Than Greater Than Or Equals Less Than Or Equals	Text box; enter number of bytes to search for
Bytes Sent	Equals Does Not Equal Greater Than Less Than Greater Than Or Equals Less Than Or Equals	Text box; enter number of bytes to search for
Main Class	Is One Of Is Not One Of Matches Does Not Match	Text box; begin typing a message class or click to see a pre-populated list of suggestions split into: Good Mail Not Spam Allow listed False-positive Bad Mail Block listed False-negative Phish Virus Spam Locked Other Greylist Unsure Unknown Error
Sub Class	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter the Sub Class of a message to search for
Extra Class	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match Greater Than Less Than Greater Than Or Equals Less Than Or Equals	Text box; enter Extra Class to search for
Error Class	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Error Class to search for false-positive A message that has been reported to the filtering system as a false positive (i.e. Trained as Not-Spam). This message which was caught as spam when it should not have been. false-negative A message that has been reported to the filtering system as a false negative (i.e. Trained as Spam). This message which was received as legitimate when it should not have been.
From	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter From address to search for
To	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter To address to search for
CC	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter CC addresses to search for
Subject	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Subject to search for
Original Message ID	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter the Original Message ID to search for
Status	Is One Of Is Not One Of Matches Does Not Match	Text box; begin typing a message Status or click to see a pre-populated list of suggestions split into: Accepted Auto Released Blackholed Delivered Delivery Failed Quarantine Removed Quarantine Expored Quarantined Queue Bounced Bounced Queue Expired Queue Removed Queued Queued Frozen Released Not Accepted Not Accepted Rejected
Delivery Date	On Before After Between Previous	Date and time selector
Delivery IP	Matches Contains Does Not Contain Equals Does Not Equal Starts With Ends With	Text box; enter Delivery IP address to search for
Delivery Hostname	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Delivery Hostname to search for
Delivery Port	Equals Does Not Equal Greater Than Less Than Greater Than Or Equals Less Than Or Equals	Text box; enter Delivery Port to search for
Delivery Data	Contains Does Not Contain Equals Does Not Equal Starts With Ends With Matches Does Not Match	Text box; enter Delivery Data to search for
Delivery Interface	Matches Contains Does Not Contain Equals Does Not Equal Starts With Ends With	Text box; enter Delivery Interface to search for
In Archive	Yes No	Selectable buttons: Yes - Message is in archive No - Message is not in archive

The Status of a message tells you what stage the message has reached in the filtering process e.g. rejected, queued for delivery, quarantined etc. To search for messages with a specific status, use the Status rule and tick the checkboxes of the statuses you wish to include.



2. If you wish, you can use the Quick select shortcuts provided e.g. Accepted; Not accepted.

Quick select options differ depending on the query rule selected, so check the options below the rule to see what is available at that time.

3. Once you have added the rules, use the Customise dropdown to select the fields you want displayed in the search results.



There are many options available, with the most useful choices outside of the defaults being:

• Sub Class - Why the message was given the Main Class that it was assigned to the message. For example, if the message was classed as Spam, the Sub Class may be DNSBL (DNS Block listed). See Message Classes for more details on Main Class, Sub Class and Extra Class combinations.
• Extra Class - The detail on why the Main Class and Sub Class were assigned to the message. For example, if the message was classed as Spam, the Sub Class may be DNSBL (DNS Block listed), so the Extra Class will provide the DNS Block list in question. See Message Classes for more details on Main Class, Sub Class and Extra Class combinations.
• Delivery Data - Shows the destination mail server's most recent response to the filtering server's attempt to deliver. For example, if a message is accepted by the filter but can't be found in the recipient's Inbox, this field will show if the message was delivered to the destination mail server or not. To see all delivery attempts that have been made for a message, see the Delivery Failure Details/Delivery Issue Log page.
4. You may also choose to display a summary row at the bottom of the table



There are three options available for this:

• None - this will disable the summary row so nothing will be displayed
• Total - this will display a row at the bottom of the table which will calculate the total of any columns containing number values such as Bytes Sent and Bytes Received

  

• Average - this will display a row at the bottom of the table which will calculate the average of any columns containing number values such as Bytes Sent and Bytes Received

  

5. Use the Group results by: dropdown and select from the list if you want to group the results by category. For example, to group the results by sender, select Sender
6. Once you have specified your filters, click on Show Results to run the search and display the results at the bottom of the page

Status/Action	Add allow list filtering rule	Add block list filtering rule	Add sender to allow list	Block recipient	Block sender	Block sender and remove from quarantine	Change action for messages like this
auto-released
blackholed
bounced
delivered
delivery-failed
not-accepted
quarantined
quarantine-expired
quarantine-removed
queued
queue-frozen
queue-bounced
queue-removed
queue-expired
rejected
released
secure-delivered

• Add Allow list filtering rule - Add a custom incoming Allow list filtering rule. See Add an Incoming Allow list Filtering Rule
• Add Block list filtering rule - Add a custom incoming Block list filtering rule. See Add an Incoming Block list Filtering Rule
• Add Sender to Allow list - Add the sender to the Allow list, causing all future messages from this sender address to be accepted by the filter. See Manage Incoming Sender Allow list
• Block recipient - Add the recipient to the Block list, causing all future messages to this recipient address to be treated as spam. See Manage Recipient Block list
• Block Sender - Add the sender to the Block list, causing all future messages from this sender address to be treated as spam. See Manage Incoming Sender Block list
• Block sender and remove from quarantine - Remove the message from the quarantine and Block list the sender, causing all future messages from this sender address to be treated as spam. See Block Sender and Remove Quarantined Messages
• Change Action for messages like this - Incoming messages only - Add a custom action to incoming messages to change the response from Spam Experts, see Customise Actions

  This action currently only appears if you have included the main class, sub class, and extra class columns in your search.

Status/Action	Audit Log	Delivery issue log	Download quarantined message	Export as .CSV	Recipient callout	Remove from queue and notify sender	Retry delivery from queue	Sender callout	Telnet SMTP test
auto-released
blackholed
bounced
delivered
delivery-failed
not-accepted
quarantined
quarantine-expired
quarantine-removed
queued
queue-frozen
queue-bounced
queue-removed
queue-expired
rejected
released
secure-delivered

• Delivery issue log - See Delivery Failure Details/Delivery Issue Log
• Download Quarantined Message - Download the email(s) as .eml format in a .zip
• Export as .CSV - Download the current log results for the selected messages and columns in CSV format
• Recipient callout - Run a Network Tools > SMTP test to verify the recipient address is accepted on the destination server for the incoming domain. See What are recipient callouts/recipient verification?
• Remove from queue and notify sender - Delete the message(s) from queue and notify the sender of the email(s) that it has been rejected by the recipient
• Retry delivery from queue - Attempt to deliver the message from the queue
• Sender callout - Run a Network Tools > SMTP test to verify the sender address is accepted on the destination server for the incoming domain. See What are recipient callouts/recipient verification?
• Telnet SMTP Test - Run a Network Tools > SMTP test with the envelope sender and envelope recipient addresses of the selected message, to the destination server for the incoming domain

Status/Action	Compose Reply	Download queued message	Remove from queue	View email
auto-released				* Available only if archived
blackholed				* Available only if archived
bounced				* Available only if archived
delivered				* Available only if archived
delivery-failed				* Available only if archived
not-accepted
quarantined
quarantine-expired
quarantine-removed
queued
queue-frozen
queue-bounced				* Available only if archived
queue-removed				* Available only if archived
queue-expired				* Available only if archived
rejected
released				* Available only if archived
secure-delivered				* Available only if archived

• Compose reply - Reply to the sender of the message using the inbuilt using the Compose Email tool with the original message subject, and recipient prepopulated
• Download Queued Message - Download the email(s) as .eml format in a .zip
• Remove from queue - Delete the message(s) from queue
• View email - View the content of the email in the dashboard. See View Message Content

Status/Action	Release from quarantine	Remove from quarantine	Release and train from quarantine	Remove from queue and train as spam	Train as spam
auto-released
blackholed
bounced
delivered
delivery-failed
not-accepted
quarantined
quarantine-expired
quarantine-removed
queued
queue-frozen
queue-bounced
queue-removed
queue-expired
rejected
released
secure-delivered

• Release from quarantine - Attempt delivery of the quarantined message(s). See Release Quarantined Messages
• Remove from quarantine - Delete the message(s) from quarantine storage. See Remove Messages from Quarantine
• Release and train from quarantine - Submit quarantined message(s) to be delivered, and flag for training as not spam. See Release and Train Quarantined Messages and Report messages as Spam or Not Spam/Train Messages
• Remove from queue and train as spam - Delete the message(s) from queue and Report messages as Spam or Not Spam/Train Messages
• Train as spam - Train the selected message as spam. See Report messages as Spam
• Download Quarantined Message - Download the email(s) as .eml format in a .zip

Status/Action	Delete archived message	Export message from archive	Redeliver archived message
auto-released	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
blackholed
bounced
delivered
delivery-failed
not-accepted
quarantined
quarantine-expired
quarantine-removed
queued	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
queue-frozen	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
queue-bounced	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
queue-removed	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
queue-expired	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
rejected
released	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain
secure-delivered	* available only if Archiving is enabled for the Domain and the 'Delete Archived Messages' option is enabled	* available only if Archiving is enabled for the Domain	* available only if Archiving is enabled for the Domain

• Delete archived message - Hide the message in the archive, this will mean the selected message(s) are no longer visible to any user viewing the Archive
• Download archived message - Download a copy of the archived message(s) to your machine as .eml format in a .zip
• Export message from archive - Exports the archived message to your machine
• Redeliver archived message - Redeliver the archived message to the recipient(s). This is useful if the message cannot be found in the email inbox

Status/Action	Add and configure identity	Lock identity	Lock user
auto-released	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
blackholed	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
bounced	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
delivered	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
delivery-failed	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
not-accepted	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
quarantined	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
quarantine-expired	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
quarantine-removed	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
queued	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
queue-frozen	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
queue-bounced	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
queue-removed	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
queue-expired	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
rejected	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
released	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail
secure-delivered	* Only if an identity is used for outbound mail	* Only if an identity is used for outbound mail

• Add and configure identity - Add a new identity based on the message the action was taken against. See Manually Add Identities
• Lock Identity - If an identity is locked, they will not be able to relay any emails until it is unlocked manually. See Manage Identities
• Lock User - Locks the Outgoing User/Authentication method from authenticating outgoing mail. See Lock and Unlock an Outgoing User/Authentication Method