Please obtain the email log of the affected message, steps as follows

  1. Sign in to the Google Admin console .  You must sign in as a super administrator.
     
  2. Click Reports.
     
  3. Click Audit > Email Log Search.
     
  4. Select a date range using the drop-down list, or specify the range using the calendar. The range is limited to the last 30 days.

    To view all messages sent and received during a selected date range, skip to step 7.

  5. If you specify a date range and also want to specify a time range, click the displayed time to enter a different start and end time for the range of messages to search.

    Note: The time zone is displayed adjacent to the date selection. The times shown represent the time zone of the computer used to sign in to the Admin console.

  6. Enter search criteria in one or more of the following fields:
    • Sender—Enter the email address of the sender, either the complete address or a partial match. 
    • Recipient—Enter the email address of the recipient, either the complete address or a partial match.
    • Sender IP—Enter the IP address of the message sender.
    • Recipient IP—Enter the IP address of the message recipient.
    • Message ID—Enter the unique message identifier located in the message header, such as:CAMrEYLjgm15=0+tp4JpwMV5J=JnR=qjQekfna3ZCZMwjwH-x9w@mail.gmail.com

      See Message headers for instructions on finding message headers of particular mail providers.

  7. Click Search. A counter appears showing how long the query is taking. It can take up to one hour for a message to be logged.

    A list of messages matching your search parameters appears.

    Email log search results

    Note: If the search return more than 10,000 results, an alert appears. Some messages may display the message ID only, with N/A in the other fields. To view details for one of these messages, click the message ID in the list. This makes it appear in the Message ID search field, and you can then run a search on just this message.

  8. Perform any of the following tasks on the search results list:
    • Click the arrows in the upper-right corner to navigate through the pages of the list.
    • Click a subject (or message ID) to see the message’s details. See Viewing message details with email log search for a description of the information shown.
    • To export or download your search results, click Download-export icon in the upper-right corner of the screen, and then click either Export to Google Sheets or Download as CSV file.

      The button appears only if the search results return exportable data. Selecting either of these options initiates a new query, so it may take some time before the file is ready to open. If you download the search results, you can view them in a spreadsheet editor of your choice.

      Export or download