Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=email-history-processed-report

Processed report

The Processed report shows messages that have been processed by Sophos Email. If a message is sent to more than one recipient, there's only one row for that message.

Quarantine summary emails sent to your users don't appear in this report.

Note

Whether a message is quarantined or deleted depends on the spam protection settings you've chosen, see Email Security policy.

Table

For each processed message, the report shows the following details:

  • Direction: Inbound or Outbound. Click the arrows to sort the rows.
  • Sender: The email address of the sender.
  • Recipients: The email addresses of the recipients.
  • Type: The type of message, either "Gateway" or "Mailflow".
  • Subject: Click the subject of a message to see its details.
  • Last Status: The most recent activity for the message. See Last Status.
  • Date: The date of the most recent activity for the message.
  • Category: The category of the message. See Message Categories.

Last Status

The possible values for Last Status can be as follows.

  • Deleted: The message was deleted due to its content or your block list configuration.
  • Quarantined: The message was marked as spam due to its content or your block list configuration. You can view quarantined messages on the Quarantined Messages page.
  • Bounced: The message was returned to the sender, with a reason for not delivering it.
  • Redirected: The message wasn't delivered to the original recipient. It was redirected to another email address.
  • Processing: The message is still being processed. This applies to messages in the sandbox environment and messages queued for delivery.
  • Accepted: The message was received successfully and is being processed by our system.
  • Delivery Successful: The message was processed successfully and sent for delivery.
  • Delivery Failed: The delivery of the message was attempted several times, but it couldn't be delivered, and the request timed out.

  • Queued for Delivery: The initial delivery attempt failed, and the message is re-queued for delivery.

    We attempt to deliver inbound messages for up to five days and outbound messages for up to one day. Possible reasons for failure are the recipient mail server being offline, or issues retrieving the recipient's DNS records. Messages queued for delivery that are now in the processing phase show as "Processing".

  • Processing Encryption: The message is still in the process of being push encrypted, or the push encrypted message is waiting to be delivered after the recipient sets their password.

  • Encrypted Delivery: A message encrypted by Push Encryption was delivered.
  • Portal Delivery: A message encrypted by Portal Encryption was delivered to the Sophos Secure Message portal.
  • TLS Delivery Failed: The outbound messages that couldn't be delivered securely using TLS.
  • Returned to M365: A Sophos Mailflow email was successfully returned to Microsoft 365.
  • Queued for return to M365: A Sophos Mailflow email was put in a queue to be returned to Microsoft 365.
  • Failed to return to M365: A Sophos Mailflow email couldn't be returned to Microsoft 365.
  • Clawback Successful: The message was successfully clawed back to post-delivery quarantine after being delivered to recipients.
  • Clawback Initiated: The process to claw back the message has been initiated.
  • Clawback Failed: The attempt to claw back the message failed.
  • Clawback Released: The clawback request has been canceled or released. The message won't be clawed back.

Filter messages

You can use the Filter panel on the left side of Message History to refine the list of displayed messages. This helps you quickly narrow down results without using Advanced Search.

You can filter messages by the following criteria:

  • Category: Filter by categories such as Spam or Malware.
  • Status: Filter by delivery status such as Delivery Successful or Quarantined.

  • TLS encryption: Filter messages based on how they were encrypted during delivery.

    Note

    In Gateway mode, TLS encryption refers to the connection between Sophos Email and the external sender or recipient.

    In Mailflow mode, TLS encryption refers to the connection between Sophos Email and Microsoft 365 through the configured connector.

    • Unencrypted: Messages delivered without using TLS encryption.
    • Encrypted: Messages encrypted using TLS version 1.2 or 1.3.

You can apply multiple filters at once. After you've selected the filters, click Apply to update the report. Click Reset to clear all filters.

Note

The available filters might change based on the selected date range or message direction.

In Message History, you can use Advanced Search to filter and find specific messages.

Click Advanced Search to begin.

You can filter messages by the following search fields:

  • From: Sender. Supports partial strings. Not case sensitive.
  • To: Recipient. Supports partial strings. Not case sensitive.
  • Subject: Supports partial strings. Not case sensitive.
  • Message size: Greater than or less than a number of MB. This uses the MIME size of an email, which may be greater than the raw file size. See Calculating email attachment file sizes.
  • Attachment: Type of attachment. Supports partial strings.

  • DSN code: Select a delivery status notification (DSN) code.

    You can enter an entire DSN code, or select one of the following options:

    • 2.*.*: Successful delivery
    • 4.*.*: Transient failure
    • 5.*.*: Permanent failure

Note

  • When we analyze senders and recipients of messages, we use the SMTP envelope sender and recipient addresses, not the From and To message headers.
  • Special characters, including punctuation marks such as periods, commas, and hash symbols #, as well as symbols, accent marks, ASCII control characters, and formatting characters, are ignored in the search criteria fields.

You can configure several search criteria. The search results will include messages that match all criteria.

You can also filter messages by Type, Direction, Category, Status, or TLS encryption.

If you change the date range or filter the messages, you must click the Refresh icon Refresh icon. to update the search results.

In your search results, the parameters you selected appear in the search box. You can click individual parameters to remove them from the search. Your search results are updated immediately.

You can click the direction arrow to limit your search to inbound or outbound messages. The down arrow is for inbound messages, and the up arrow is for outbound messages. If you click a direction arrow, your search results are updated immediately.

Schedule a report

You can schedule the Processed report as a custom report. Save as Custom Report lets you save the Processed report using the "Message History" template on the Reports page.

Show me how

For more information on saving or scheduling reports, see Email reports.