--- schema_version: "1" id: 2c321e93e6cd8375332c52dd955f279c4ea6889eab467478ebc4107837cb0ec0 title: Email Log File Fields collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/email_logs_format.md canonical_url: https://help.salesforce.com/s/articleView?id=sales.email_logs_format.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: e1047b6cc90113ba3c3564e73bc509169fb4b7a6b33d160b2b4148f68ce2a206 description: Use the fields in an email log file to investigate email delivery status, errors, security, and authentication. products: - Sales Cloud - Cross Cloud - Service Cloud Voice release: "264" --- # Email Log File Fields Use the fields in an email log file to investigate email delivery status, errors, security, and authentication. ### Required Editions
Available in: Lightning Experience and Salesforce Classic
Available in: All Editions except Database.com
User Permissions Needed
To access email logs: Modify All Data
Each row of the log file contains these fields.
Field Definition
Date/Time

The date and time that the Mail Event occurred, in UTC.

Example: 3/06/2009 13:37
Internal Message ID

The unique internal ID of the message

Example: 16/A4-20983-88E21E84

Mail Event

The latest email event in the mail server. Each Mail Event has one of these values.

R
Reception. The Mail Transfer Agent (MTA) received the message.
D
Delivery. The message was delivered.
T
Transient failure. The email transmission was delayed. Salesforce retries delivery over a 24-hour period. The first attempt occurs five minutes after the first transient failure, the second occurs ten minutes after that, the third twenty minutes after that, and so on.
P
Permanent failure. The email couldn’t be delivered.

Example: T
Recipient

The email address of the person to whom the email is sent.

Example: admin@acme.com
Sender

The Envelope From address used in the email. The default value is the email address of the person who sent the email. If Email Security Compliance or Bounce Management is enabled, this address contains *.bnc.salesforce.com.

Example: user@acme.com
Remote Host

The IP address of the application server that delivered the email to the email server

Example: 10.0.0.1
Bytes Transferred

The byte size of the email.

Example: 11856
User ID

The Salesforce ID of the user who sent the email.

Example: 00540000000rSXT
Message ID Header

The ID header at the beginning of every email.

Example: 21749386.​106091224027705044.​JavaMail.​sfdc@na2-app4-2-sjl.​ops.sfdc.net

Retry Count

The number of attempts made to deliver the email.

Example: 11
Seconds in Queue

The number of seconds the email message waited in the queue before delivery.

Example: 300
Delivery Stage

The delivery stage of the email.

Here are the values of the stages in the order that they appear during the SMTP sequence.

BANNER
The Simple Mail Transfer Protocol (SMTP) connection response.
EHLO
The beginning of the session with the mail server.
STARTTLS
Establishes a secure communication session with the email server.
MAIL FROM
Announces the sender of the email.
RCPT TO
Announces the recipient of the email.
DATA
Announces that the subsequent text is the email message.
BODY
The SMTP server sends the body of the email to the recipient.
RSET
Resets the server state, ending the session.

These responses can appear at any point during the delivery sequence.

while not connected
The client is trying to establish a connection.
while idle
The client has connected, but isn’t sending or receiving any commands.
reading confirmation
A command was sent and the client is waiting for a response.
handshaking TLS
An error occurred while trying to establish a secure connection.
out of band bounce
The receiving server accepted a command, but then rejected the command for an unknown reason.
in unknown state
An unknown error occurred.

Example: during RCPT TO
Relay Address

The hostname of the designated relay system.

Example: relay.my.org
Relay Port

The port of the designated relay system

Example: 587
Delivery Status Notification

After every delivery stage, the mail server sends a three-digit response code. The first number indicates whether the command was successful or unsuccessful. The second digit indicates the type of error, and the third digit provides additional information to resolve the potential problem.

Use the first digit to determine the state of the message.

  • 1xx—Positive preliminary reply. The command was accepted, but the server has received no response.
  • 2xx—Positive completion reply. The requested action was completed successfully.
  • 3xx—Positive intermediate reply. The command was accepted, but the requested action requires more information.
  • 4xx—Transient negative completion reply. The command wasn’t accepted and the requested action didn’t occur. However, the error condition is temporary and the mail server can request the action again.
  • 5xx—Permanent negative completion reply. The command wasn’t accepted and the requested action didn’t occur.

Every email service provider implements the codes differently, so there’s no comprehensive list for what the second or third digits indicate.

For more information on these codes, view the official SMTP documentation, section 4.2.1: http://​www.ietf.org/rfc/rfc2821.txt​?number=2821

Example: 421 no adequate servers

TLS_Cipher

For successfully delivered emails, the email’s encryption. This information is valid only when Mail Event is D.

TLS version:cipher
The Transport Layer Security (TLS) version and cipher.
:
The message wasn’t encrypted.
None
The message was used for an internal delivery.

Example: TLSv1.2:AES256-GCM-SHA384
TLS_Verified

If the email was encrypted and successfully sent, this value indicates whether the client verified the encryption certificate with the configured certificate authorities.

Verified
The client verified the peer certificate with the configured certificate authorities.
Unverified
The client couldn’t verify the peer certificate with the configured certificate authorities.

This information is valid only when Mail Event is D for delivery.

Example: Verified
Email Direction

The direction of the email.

Inbound
Emails sent via external senders to specific service addresses in Salesforce.
Outbound
Emails that originate in Salesforce and sent to targeted recipients.

Example: Outbound
Sent via TLS

Indicates whether the email was sent via TLS.

true
Sent via TLS
false
Sent without TLS

Example: true
TLS Option

The TLS setting used for the email.

0
None.
1
Preferred. If the message transfer agent (MTA) advertises TLS and a common cipher was negotiated, TLS was used. If TLS couldn’t be negotiated, the email was delivered.
2
Required. If TLS couldn’t be negotiated or a common cipher couldn’t be agreed on, the email bounced back to the originator.
3
Preferred Verify. If the MTA advertises TLS, a common cipher was negotiated, and Salesforce verified the receiver, TLS is used. Verification means that a valid certificate authority signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected. If TLS couldn’t be negotiated or the verification failed, the email was delivered unencrypted.
4
Required Verify. If TLS couldn’t be negotiated, a common cipher couldn’t be agreed on, or the sender couldn’t be verified, the email bounced back to the originator. Verification means that a valid certificate authority has signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected.

Example: 1
SPF status

The Sender Policy Framework (SPF) authentication status of the email.

Pass
The SPF check succeeded, and the email passed the authentication process.
Fail
The SPF check failed.
None
An SPF record wasn’t published for the sender's domain.

Example: Pass
Sender ID status

Sender ID authentication status of the email.

Pass
The Sender ID check succeeded, and the email passed the authentication process.
Fail
The Sender ID check succeeded, and the email passed the authentication process.
None
No Sender ID check was performed.

Example: Pass
Sender ID PRA status

The Sender ID PRA (Purported Responsible Address) authentication status of the email.

Pass
The Sender ID PRA check succeeded, and the email passed the authentication process.
Fail
The Sender ID PRA check failed, or the email failed the authentication process.
None
No Sender ID PRA check was performed.

Example: Pass
DomainKeys status

DomainKeys status of the email.

Pass
The DomainKeys check succeeded.
Fail
The DomainKeys check failed.
None
Typically occurs when a DomainKeys check wasn’t performed.

Example: Pass
Header From

The From field in the email header.

Example: My Email <my.email@example.com>
DKIM Selector

The DKIM selector of the email.

A DKIM selector is a string used to locate the appropriate public key in the sender's DNS records.

In this example DKIM signature, the DKIM selector is selector202307.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector202307; c=relaxed/simple; q=dns/txt; h=From:Subject:Date:Message-ID; bh=XXXXXXXXXXXXXXXXXXXXXX; b=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY

Example: selector202307
DKIM Domain

If a DomainKeys Identified Mail (DKIM) key signed the email message, the domain for the cryptographic keys used to sign the email message.

In this example DKIM signature, the DKIM Domain is example.com.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; ...

Example: example.com
DKIM Success

Indicates whether the DKIM-Signature header was included in the email headers.

true
The email headers included the DKIM-Signature header.
false
The email headers didn’t include the DKIM-Signature.
none
Either the DKIM Domain or DKIM Selector wasn’t available.

Example: true
#### See Also - [Check the Delivery Status of Email Sent from Salesforce](https://help.salesforce.com/s/articleView?id=sales.email_logs_edit.htm&release=264.0.0&type=5 "Request an email log to investigate the delivery of email sent through Salesforce in the last 30 days. Email logs support general troubleshooting and delivery analysis, but occasional limits on data availability make them unsuitable for audit, compliance, or legal evidence.") - [Email Log Considerations and Limits](https://help.salesforce.com/s/articleView?id=sales.emailadmin_emaillogs_considerations.htm&release=264.0.0&type=5 "Before you request an email log, review request limits, what an email log includes, and when log data can be incomplete. Email logs help Salesforce admins investigate the delivery of email sent through Salesforce, but email logs aren't an audit record.") - [Certificates and Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_about.htm&type=5&language=en_US) - [_Knowledge Article_: How to Check the Permanent Failure Rate of Emails Sent from Salesforce](https://help.salesforce.com/s/articleView?id=000363421&type=1&language=en_US) - [Email Logs](https://help.salesforce.com/s/articleView?id=sales.emailadmin_monitor_emails_sent_from_salesforce.htm&release=264.0.0&type=5 "Request an email log to investigate the delivery of sent through Salesforce within the last 30 days. Email logs contain delivery information for each message, including the sender and recipient, date and time, delivery, and any associated error codes. Email logs serve as a troubleshooting tool, but occasional limits on data availability make them unsuitable for audit, compliance, or legal evidence.")