Trace an email with its full headers and Email Log Search

Problem

Messages being received by other user apart from original user.

Environment

  • Gmail
  • Admin Console

Solution

Read email full headers

  1. Open the email you want to check the headers for.
  2. Next to Reply > click More > Show original.
  3. Copy the text on the page.
  4. Open the Message header tool.
  5. In Paste email header here paste your header.
  6. Click Analyze the header above.

Find messages with Email Log Search

  1. In your Google Admin console.
  2. Go to Menu > Reporting > Email Log Search.
  3. Select a date range from the menu, or specify a range using the calendar.
  4. (Optional) If you specify a date range and also want to specify a time range, enter a different start and end time for the date range. Times are shown in the time zone of the computer that you're using with the Admin console.
  5. (Optional) Enter search criteria in any of the following fields:
    • Sender—All or part of the sender's email address or Return-Path address. The sender's Return-Path address is contained in the message header. To search for an exact match, enter the complete email address and enclose it in quotes, for example, john@solarmora.com.

      Note: When searching for a message sent to a group email address, search by message ID. Searching with the group address as the recipient won't show the delivery to individual group members.

    • Recipient—The recipient's complete or partial email address.
    • Sender IP or Recipient IP—The exact IP address of the sender or recipient. IP addresses that aren't exact don't return any messages in the search.

      Note: When you search with Sender IP, the results might show a Google outbound IP address instead of the public outbound IP address for your domain. Gmail sends outgoing messages through Gmail servers, which use Google outbound IP addresses.

    • Subject—An email subject line or part of a subject line. This option is case-insensitive. For the message to be returned, the subject line text must match exactly the text you enter in this field. This search option isn’t available for all accounts.
    • Message ID—The unique message ID located in the message header. If you also specify a date and time range, this option overrides date and time range. Searching by Message ID returns matching messages, even if they're outside a specified date range.

      Visit Trace an email with its full headers for instructions on how to find the message ID for different mail providers.

  6. Click Search. Search results are returned within a minute or two. Sometimes, it can take up to an hour.
    • Search results are limited to 1000 messages.
    • For multi-page results, use the arrows at the top or bottom of the message list to change pages.
    • Click a subject or message ID for message details, including delivery path and status. Learn more.
    • If you get too many results, try to narrow your search.