Table of contents:

1. Introduction

The Email Flow Logs section allows users to search and analyze the processing of emails within mxHERO’s platform, allowing users to determine the status of any message, the rules that were applied, its final recipients, basically the complete sending flow. 

This section can prove essential for auditing, troubleshooting, and verifying the correct application of email policies within your organization.

2. Navigation Overview

You can access the Email Flow Logs section within the Reports section, located in the dashboard's navigation sidebar.
This section is comprised mainly by the following elements and sub elements:

• Filters Form (common)
• Search Logs tab
  • Search result table
  • Email log details
• Log Reports tab
  • Report field selection window
  • Generated reports table

3. Filters (Search & Reports)

The Filters form allows users to narrow down and refine the information displayed in both the Search Logs and Reports tabs.

By selecting specific criteria, users can locate relevant email records, focus on particular time ranges or attributes, and ensure that the displayed results or generated reports reflect the data they need. The same set of filters is shared across both views to provide a consistent and efficient search experience.

3.1 Available Filter Fields

• Sender: Filters emails by the sender’s address. You can enter a partial value to match any sender that contains the entered text.
• Recipient: Filters emails by recipient address. Partial entries are supported and will return any email where the recipient contains   the specified text.
• Subject: Filters emails based on the subject line. Entering a partial subject will match any email whose subject includes the provided text.
• Message ID: Filters emails by their Message ID. Partial values are allowed, making it easier to find emails when only part of the ID is known.
• From Date: Sets the start date for the search range. You can select any date from June 1, 2025 up to today. 
• From Time: Defines the start time for the selected From Date, allowing you to further narrow the beginning of the search range.
• To Date: Sets the end date for the search range. You can select any date from June 1, 2025 up to today.
• To Time: Defines the end time for the selected To Date, specifying when the search range should stop.
• Delivery Status: Filters emails based on their delivery outcome. You can select specific statuses to quickly view only the emails that match the chosen delivery state.
• Has Attachments: Filters the results to include only emails that contain one or more attachments.

3.2 Delivery status
Each of the available values for this filter represents a specific outcome or state of the email, helping you understand exactly what each status means and how it affects the search results. The available values are the following: 

• Any status: Includes all available emails that match the current filter criteria.
• Dropped by Rule Action: The email was blocked or discarded automatically due to a configured rule in the system. 
• Rejected by Organization Filter: The email was refused by the recipient organization’s filtering policies and was not delivered.
• Returned to Sender (Bounced): The email could not be delivered and was sent back to the sender, typically due to an invalid address or mailbox issue.
• Retained Emails: The email was held in the system and was not delivered yet, mails in this state are waiting for user approval or complying with a delay configuration.
• With Errors: This filter covers emails that experienced delivery or processing errors but were ultimately successfully delivered.
• With Rule Errors: Emails that meet the criteria of an organization's configured rules but could not be processed due to errors during the rule execution.
• With storage errors: Emails that experienced cloud storage execution issues while a rule was being processed. This filter allows for greater detail, enabling the specification of particular errors.
  • Links sharing errors: Errors occurred during the attempt to generate a share link for the content. 
  • Upload to storage errors: Errors encountered when attempting to upload files to the configured cloud storage service.
  • Folder collaboration errors: Errors occurred while trying to access or interact with the shared folders for the configured cloud storage service
  • Set mxHERO metadata errors: Failure occurring when attempting to associate mxHero's email data with the corresponding shared files.
  • Set metadata errors: Failure occurring when attempting to add metadata to shared files.
  • User storage connection errors: The system was unable to connect to the user’s cloud storage account. This may be due to authentication issues, expired tokens, or temporary connectivity problems. 
  • Attachment extraction errors: Attachment processing errors resulting from a rule configuration.
  • Email extraction errors: Errors occurred while trying to extract an email’s body, create a file to be uploaded to a cloud storageErrors encountered during the process of extracting an email's body or attempting to create a file for upload to cloud storage.

4. Search Logs Tab

The Search Logs tab allows users to view and analyze email activity records. Using the Filters form, you can narrow down results by sender, recipient, subject, message ID, dates, delivery status, and attachments. The tab displays a results table where each row represents an individual email, and users can access detailed information (including parent email details and recipient information) by selecting a specific entry. 

4.1 Search Log Results Table

Displays the list of emails matching the applied filters.

4.2.1 Table Columns

 Each row shows the following key information: 

• Subject (the email’s subject line),
• From (the sender’s address),
• Date (when the email was sent). Users can click on a row to view detailed email information.

4.2.2 Pagination

The results are displayed in pages, and you can adjust the number of results per page using the controls at the bottom of the table. By default, this value is set to 100, which is the number of records retrieved for each search. If your search yields more than 100 results, the "Get More" button will become available, allowing you to fetch additional results using the same applied filters.



4.2.3 Row Action

Clicking on any row in the results table will direct the user to the email details view, which provides comprehensive information for that specific email record.

5. Email Details View

The Email Details view provides a comprehensive look at a selected email. It displays the parent email information such as sender, subject, timestamps, and status alongside detailed information for each recipient, including delivery status and any errors encountered. This view allows users to thoroughly investigate the email’s journey, attachments, and processing outcomes.

5.1 Status Overview

The status overview presents a summary of the email's recipient statuses. This information is displayed using a series of cards, each indicating the amounts for a specific recipient status.

5.2 Parent Email Details

Shows the main information of the selected email, including the subject, from, message ID, timestamps, sender, recipients and any general processing notes. This section provides a complete overview of the original email before considering individual recipient details.

5.2.1 Parent Email Actions

Provide a comprehensive record of all actions taken on an email before its delivery to recipients. This includes system processes, retention steps, and rule evaluations that influenced the email's handling. This detailed log is essential for users to understand the pre-distribution processing of the email. A JSON file containing the complete action log is available for download.



5.3 Recipients Details List

Displays a list where each entry corresponds to a recipient of the selected email. Each item offers an overview, showing the recipient's email address, the latest delivery status, and a timestamp of the last action. These entries can be expanded to reveal all delivery actions, including any errors or recipient-specific processing notes. This feature enables users to effectively monitor how the email was handled for every individual recipient. A JSON file containing the complete action log is available for download.
 

5.4 Latest Status

This column shows the most recent processing status for a parent email or for each recipient of the selected email. It reflects the latest action taken—such as delivery, storage, or error and indicates the current outcome of how the email was handled for that recipient. The list below includes all potential statuses for a recipient:
 

Mail Received: The system successfully accepted the email for processing. (Parent email only)

Mail Split: The email was separated into individual recipient-specific messages for independent processing. (Parent email only)

Mail Delivered: The email was successfully delivered to the recipient’s mail server.

Mail Bounced: Delivery failed because the recipient’s mail server rejected it after acceptance, typically due to an invalid address or mailbox issue.

Mail Rejected: The recipient’s mail server refused the email during the delivery attempt, before accepting it.

Mail Dropped: The email was intentionally discarded without delivery, usually due to policy, filtering rules, or security decisions.

Mail Quarantined: The email was isolated for review due to security, compliance, or policy concerns.

Mail With Error: An error occurred during processing that prevented successful delivery or completion.

Rule Executed: One or more processing rules were evaluated and executed for the email.

Storage Requested: A request was made to store the email or its metadata, but processing is not yet complete.

Storage Executed: The email or its metadata was successfully stored as requested.

Reprocessing: The email is being re-run through the processing pipeline after a previous failure or manual action.

Rule Execution Failed: An error occurred while executing one or more processing rules, preventing the email from being

6. Reports Tab

The Reports tab allows users to generate, view, and manage email reports. Users can select specific fields for their reports, apply filters, and see a list of previously created reports with details such as name, creation date, and status. Generated reports are exported in CSV format and downloaded as compressed ZIP files for easy storage and sharing. To generate a report, first fill out the Filters form with your criteria, then click Create Report. A field selection window will then appear, allowing you to choose which columns to include in the report.

Generated reports reflect email information from the perspective of the recipients, meaning that multiple rows in the CSV may correspond to the same email but represent data specific to each individual recipient. Each report can include up to 500,000 results.

6.2 Report field selection

The Field Selection Popup lets users choose which columns and data fields to include in a CSV report, customizing the content and structure of the exported file. It can be accessed by clicking the Create Report button in the Filters form.

• recipient: The individual or address to which the email is delivered.
• receivedAt: The date and time when the email was received and processed by the system.
• receivedId: A unique identifier assigned to each batch of emails sent by the server that connects to mxHERO. The same email may have multiple receivedId values if it is processed in different batches. Additionally, if the sender resends the same email, a new receivedId may be generated even for the same recipients.
• receivedMsgUID: A unique identifier generated by combining the email’s Message ID and sender. This ID uniquely represents a specific sent email and remains consistent throughout all stages of the email’s lifecycle.
• recipientMsgUID: A unique identifier generated by combining the sender, messageId, and recipient. This ID uniquely represents a specific email for a particular recipient.
• action: The most recently updated delivery status for the recipient, reflecting the latest action taken on the email.
• actionCreatedAt: The date and time when the current recipient delivery action was created or recorded.
• messageId: A unique identifier assigned to each email by the sending server, used to track and reference the message throughout its lifecycle.
• subject: The subject line of the email, which provides a brief summary or title for the content. It helps recipients quickly understand the purpose or topic of the message.
• sender: The email address of the person or system that sent the email.
• from: The displayed “From” address in the email header, indicating who the email appears to be sent from.
• to: The email address(es) of the primary recipient(s) of the email.
• bytes: The total size of the email in bytes, including headers, body, and attachments.
• attachments: A list of the file names, including extensions, for all files attached to the email.
• isTnef: Indicates whether the email contains a TNEF (Transport Neutral Encapsulation Format) attachment, commonly used by Microsoft Outlook to encode rich text formatting and embedded objects.
   

6.2.1 Selecting and Deselecting Fields

The field selection window for a report allows users to select individual columns or use a button to select or deselect all columns at once. This functionality applies to all fields except recipient and receivedAt, which are mandatory and will always be included in the report.

6.3 Created Reports Table

Shows a list of previously generated reports with columns for 

• Created: the report’s creation date
• Status: current processing or availability status.
  - mail_delivered: After mxHERO processing was completed and the email was successfully delivered to the external MTA.
  - mail_dropped: The email was dropped while a hold rule was running (This action can be seen in many cases. Examples are mails canceled by Request Approval or emails sent to Forwarding Address. Block Attachments rules may also trigger a drop.)
  - mail_received: After mxHERO processing was completed, the email was successfully delivered to the internal MTA. (This action can happen in 2 stages: The first is when reviewing an email on the top sections it means that the mail was received by the server. The second stage is when reviewing actions per recipients it means that our server already has done the “per recipient split” and is processing the individual recipient.)
  - quarantine_added: The email was rejected while running an approval rule. (This status it only states that email was sent to quarantine and is waiting for request approval or temporary hold final execution of the email.)
  - mail_reject: The email was bounced because the attachment processing could not be completed according to the user’s rule. (Note:"mail_reject" occurs only when the customer has selected “More actions ＞ Bounce email to sender” in the Protect Attachment rules.)

• Requester: the user who generated the report

For each report, users can view applied filters or download the compressed CSV report. This table helps users manage and track all their generated reports efficiently.
Generated reports are available for download for 5 days after creation, after which they are automatically deleted. This table helps users manage and track all their generated reports efficiently.

6.4 Report Generation Best Practices

• To group all recipients of a single email in a report, it is best to use receivedMsgUID or Message ID.
• To group batches of recipients sent by the external server to mxHERO, use receivedId.
• To group emails received by a specific recipient for a given sender, use recipientMsgUID.