Viewing logs

Click View log to see full details of the message processing and results. The log appears at the bottom of the message details page.

For a quarantined message, the log details provide the exact reasons for the quarantine. For example:

• For messages quarantined due to a virus, the log lists the virus name.
• For blocked attachments, the log includes the file type or class that matched against the attachment.
• For blocked images, the log includes a thumbnail of the image. See Managing quarantined images.
• For lexical rule failures, the log lists the phrase that triggered the quarantine.
• For spoofed messages, the log details the outcome of the spoofing detection checks used to validate the message. The log entry may include the following items:
  • DMARC: pass or fail, based on DKIM and SPF checks
  • DKIM: checks the digital signature of the sender’s domain
  • SPF: checks the SPF record for the envelope sender address
  • SPF_HELO: checks the SPF record for the SMTP HELO name
  • SPF_P2: checks the SPF record for the content sender (“from”) address.

If email is classified as commercial bulk email, the message details page may also contain log lines indicating the action taken:

• Commercial bulk message subject tag added for <recipient>.
• Commercial bulk message quarantined for <recipient>.
• Commercial bulk message detected and allowed due to policy settings for <recipient>.