Email Log File Fields

The date and time that the Mail Event occurred, in UTC.

Example: 3/06/2009 13:37

The unique internal ID of the message

Example: 16/A4-20983-88E21E84

The latest email event in the mail server. Each Mail Event has one of these values.

R

Reception. The Mail Transfer Agent (MTA) received the message.

D

Delivery. The message was delivered.

T

Transient failure. The email transmission was delayed. Salesforce retries delivery over a 24-hour period. The first attempt occurs five minutes after the first transient failure, the second occurs ten minutes after that, the third twenty minutes after that, and so on.

P

Permanent failure. The email couldn’t be delivered.

Example: T

The email address of the person to whom the email is sent.

Example: admin@acme.com

The Envelope From address used in the email. The default value is the email address of the person who sent the email. If Email Security Compliance or Bounce Management is enabled, this address contains *.bnc.salesforce.com.

Example: user@acme.com

The IP address of the application server that delivered the email to the email server

Example: 10.0.0.1

The byte size of the email.

Example: 11856

The Salesforce ID of the user who sent the email.

Example: 00540000000rSXT

The ID header at the beginning of every email.

Example: 21749386.​106091224027705044.​JavaMail.​sfdc@na2-app4-2-sjl.​ops.sfdc.net

The number of attempts made to deliver the email.

Example: 11

The number of seconds the email message waited in the queue before delivery.

Example: 300

The delivery stage of the email.

Here are the values of the stages in the order that they appear during the SMTP sequence.

BANNER

The Simple Mail Transfer Protocol (SMTP) connection response.

EHLO

The beginning of the session with the mail server.

STARTTLS

Establishes a secure communication session with the email server.

MAIL FROM

Announces the sender of the email.

RCPT TO

Announces the recipient of the email.

DATA

Announces that the subsequent text is the email message.

BODY

The SMTP server sends the body of the email to the recipient.

RSET

Resets the server state, ending the session.

These responses can appear at any point during the delivery sequence.

while not connected

The client is trying to establish a connection.

while idle

The client has connected, but isn’t sending or receiving any commands.

reading confirmation

A command was sent and the client is waiting for a response.

handshaking TLS

An error occurred while trying to establish a secure connection.

out of band bounce

The receiving server accepted a command, but then rejected the command for an unknown reason.

in unknown state

An unknown error occurred.

Example: during RCPT TO

The hostname of the designated relay system.

Example: relay.my.org

The port of the designated relay system

Example: 587

After every delivery stage, the mail server sends a three-digit response code. The first number indicates whether the command was successful or unsuccessful. The second digit indicates the type of error, and the third digit provides additional information to resolve the potential problem.

Use the first digit to determine the state of the message.

• 1xx—Positive preliminary reply. The command was accepted, but the server has received no response.
• 2xx—Positive completion reply. The requested action was completed successfully.
• 3xx—Positive intermediate reply. The command was accepted, but the requested action requires more information.
• 4xx—Transient negative completion reply. The command wasn’t accepted and the requested action didn’t occur. However, the error condition is temporary and the mail server can request the action again.
• 5xx—Permanent negative completion reply. The command wasn’t accepted and the requested action didn’t occur.

Every email service provider implements the codes differently, so there’s no comprehensive list for what the second or third digits indicate.

For more information on these codes, view the official SMTP documentation, section 4.2.1: http://​www.ietf.org/rfc/rfc2821.txt​?number=2821

Example: 421 no adequate servers

For successfully delivered emails, the email’s encryption. This information is valid only when Mail Event is D.

TLS version:cipher

The Transport Layer Security (TLS) version and cipher.

:

The message wasn’t encrypted.

None

The message was used for an internal delivery.

Example: TLSv1.2:AES256-GCM-SHA384

If the email was encrypted and successfully sent, this value indicates whether the client verified the encryption certificate with the configured certificate authorities.

Verified

The client verified the peer certificate with the configured certificate authorities.

Unverified

The client couldn’t verify the peer certificate with the configured certificate authorities.

This information is valid only when Mail Event is D for delivery.

Example: Verified

The direction of the email.

Inbound

Emails sent via external senders to specific service addresses in Salesforce.

Outbound

Emails that originate in Salesforce and sent to targeted recipients.

Example: Outbound

Indicates whether the email was sent via TLS.

true

Sent via TLS

false

Sent without TLS

Example: true

The TLS setting used for the email.

0

None.

1

Preferred. If the message transfer agent (MTA) advertises TLS and a common cipher was negotiated, TLS was used. If TLS couldn’t be negotiated, the email was delivered.

2

Required. If TLS couldn’t be negotiated or a common cipher couldn’t be agreed on, the email bounced back to the originator.

3

Preferred Verify. If the MTA advertises TLS, a common cipher was negotiated, and Salesforce verified the receiver, TLS is used. Verification means that a valid certificate authority signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected. If TLS couldn’t be negotiated or the verification failed, the email was delivered unencrypted.

4

Required Verify. If TLS couldn’t be negotiated, a common cipher couldn’t be agreed on, or the sender couldn’t be verified, the email bounced back to the originator. Verification means that a valid certificate authority has signed the receiver’s certificate and the hostname in the certificate matches the host to which we connected.

Example: 1

The Sender Policy Framework (SPF) authentication status of the email.

Pass

The SPF check succeeded, and the email passed the authentication process.

Fail

The SPF check failed.

None

An SPF record wasn’t published for the sender's domain.

Example: Pass

Sender ID authentication status of the email.

Pass

The Sender ID check succeeded, and the email passed the authentication process.

Fail

The Sender ID check succeeded, and the email passed the authentication process.

None

No Sender ID check was performed.

Example: Pass

The Sender ID PRA (Purported Responsible Address) authentication status of the email.

Pass

The Sender ID PRA check succeeded, and the email passed the authentication process.

Fail

The Sender ID PRA check failed, or the email failed the authentication process.

None

No Sender ID PRA check was performed.

Example: Pass

DomainKeys status of the email.

Pass

The DomainKeys check succeeded.

Fail

The DomainKeys check failed.

None

Typically occurs when a DomainKeys check wasn’t performed.

Example: Pass

The From field in the email header.

Example: My Email <my.email@example.com>

The DKIM selector of the email.

A DKIM selector is a string used to locate the appropriate public key in the sender's DNS records.

In this example DKIM signature, the DKIM selector is selector202307.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=selector202307; c=relaxed/simple; q=dns/txt; h=From:Subject:Date:Message-ID; bh=XXXXXXXXXXXXXXXXXXXXXX; b=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY 

Example: selector202307

If a DomainKeys Identified Mail (DKIM) key signed the email message, the domain for the cryptographic keys used to sign the email message.

In this example DKIM signature, the DKIM Domain is example.com.

DKIM-Signature: v=1; a=rsa-sha256; d=example.com; ...

Example: example.com

Indicates whether the DKIM-Signature header was included in the email headers.

true

The email headers included the DKIM-Signature header.

false

The email headers didn’t include the DKIM-Signature.

none

Either the DKIM Domain or DKIM Selector wasn’t available.

Example: true