Email Traffic Log
When somebody asks "what happened to my message?", the panel can usually answer: it keeps a structured record of every delivery it handles.
Two pages hold the evidence:
| Page | Answers |
|---|---|
| Email Traffic Log | What mail moved. |
| Email Access Log | Who signed in to a mailbox. |
Delivery records
Every message the mail service touches becomes a record, not only a line in a log file. Email Traffic Log lists them for your whole account; each domain account's page has a Traffic Log tab with its own.
Each record has a type, and the Type filter separates them:
| Type | Meaning |
|---|---|
| Incoming email | Mail from outside. |
| Outgoing email | Mail your domain users submit for sending. |
| Local forwarding | A forwarder or a group passing mail on. |
| Application-generated email | Mail sent by your own programs on the server. |
| Email that a mailbox started | Mail the system generates for a mailbox. |
| Mailing-list posts | A mailing list's posts and its administrative mail. |
One domain account's traffic is what that address sent and received; for a mailing list, the posts that arrived, the copies sent to members, and its administrative mail.
You can also filter by date range, sender, and IP address (one address or a CIDR network), or look up a message directly by the identifier in its headers. Trace a single message explains how to read the identifier out of a mailbox.
A program on your server can try to send mail with a direct call to
sendmail. If the server refuses it before anything goes out, there's no
delivery to record here; the attempt appears on
Sendmail Failures instead.
A record's detail view holds what a support conversation needs:
- the sender, recipients, subject, size, and times;
- the full headers;
- every hop the message made, in order;
- the authentication results: SPF, DKIM, DMARC, and the relayed ARC results; and
- the spam score, for incoming mail.
"You never got my message" from a sender and "authentication failed" from a receiver are both answered by the record. Sender verification explains how to read the results.
The access log
Email Access Log answers a different question: not what mail moved, but who connected to a mailbox. It exists for the whole account and, on the Access Log tab, for each domain user.
Connections are grouped so the log stays readable: one row per network, protocol, and credential, with nearby addresses in one group. A row shows the country, the first and last time, and a count of sign-ins.
It names which app password or which application the person used.
Look for a row you don't recognize: an unexpected country, a protocol the user never uses, an app password that should have been removed. That's a reason to revoke the credential on the user's Authentication tab, and one of the signs that a lockdown is needed.
- Webmail doesn't appear here. It connects from the server itself; a browser sign-in appears in the user's Sessions list instead.
- Entries are deleted after about six months.