Message History Report

The Message History report details the messages processed by Email Security for your protected mailboxes.

Restriction This option is only available if your license includes Sophos Email.

Go to Overview > Logs & Reports > Message History.

You can search messages by Subject, Sender, or Recipient.

You can select the period for which you want to view the message processing history. By default, the report displays the messages processed during the current day.

You can filter messages by Direction, Status, or Reason.

Click Update to refresh the report if you've changed the date range, entered a search term, or filtered the messages.

Click the subject of a message to see its details.

Report Details

Note We are changing Message History so that the report shows one row per message instead of one row per recipient. You may still see the previous style during the transition period.

Each row in the report shows one message that has passed through the gateway. If a message is sent to more than one recipient, there's only one row for that message.

For each message, the report shows:

The SENDER of the message.

The RECIPIENT of the message. If there's more than one recipient, the number of additional recipients appears.

The DIRECTION of the message. This column doesn't appear if the outbound flag is off.

The SUBJECT of the message. You can click the subject of a message to see its details.

The DATE of the most recent activity for the message.

The Last Status from the most recent activity for the message.

The possible values for Last Status can be as follows:

  • Delivered Successfully: The message was processed successfully and sent for delivery.
  • Quarantined: The message was marked as spam due to its content or your block list configuration. You can view quarantined messages on the Quarantined Messages page. See Quarantined Messages.
  • Deleted: The message was deleted due to its content or your block list configuration. When you select Deleted, you can select a Reason for deletion.
  • Processing: The message is still being processed. This applies to messages in the Sandbox environment and messages queued for delivery.
  • Accepted: The message was received successfully and is being processed by our system.
  • Delivery Failed: Delivery of the message was attempted several times, but it couldn't be delivered, and the request timed out.
  • Queued for Delivery: The initial delivery attempt failed, and the message is re-queued for delivery. We attempt to deliver inbound messages for up to 5 days and outbound messages for up to 1 day. Possible reasons for failure are the recipient mail server being offline or issues retrieving the recipient's DNS records. Messages queued for delivery that are now in the processing phase show as Processing.
  • Processing Encryption: The message is still in the process of being encrypted, or the encrypted message is waiting to be delivered after the recipient sets their password.

If a message is suspicious you can see the Reason it was quarantined or deleted.

Note Whether a message is quarantined or deleted depends on the spam protection settings you've chosen, see Email Security Policy.

Message Details

To view Message Details, click a message's Subject.

You can click the following tabs for more information about the message.

  • Details shows general information about the message such as subject and date, a Status Summary and a history of events for the message. Event history is grouped by Recipients.
  • Raw Header shows the header details.
  • Attachments shows the name and size of attachments.

    We calculate attachment size using the email's MIME-encoding. We don't use the size of the raw files. This means attachment file sizes are often reported as larger than the actual file. See Calculating email attachment file sizes


Depending on our message analysis you can see either Report as Spam or Report as Not Spam. You can click the link and send the message to SophosLabs to help us improve our spam detection.

In Details if multiple recipients receive a message, you can do the following:

  • Scroll through the SMTP recipients and Header Recipients.
  • You can see a list of recipients with their latest delivery status. You can also search events by recipient email address or domain. You can expand a message to see all the events associated with it.
  • Filter the messages by clicking the links under Status Summary.

You can select Add to blocklist to add the IP address to the Inbound Allow/Block list. For more information see Inbound Allow/Block.

In the Status column you can hover over the ellipsis to see the complete SMTP text for that recipient. The code is helpful for troubleshooting. See Enhanced Mail System Status Codes and