Delivery logs and auth logs

Delivery logs and auth logs

Every hosting with e-mail set up has two log views: Delivery Logs, which record every message sent from your mailboxes, and Auth Logs, which record every login attempt against your mailboxes. Both are opened for a specific hosting in https://panel.cloudweb.sk and only cover that hosting's own domains.

Delivery Logs – what it shows

Delivery Logs list outgoing mail only – messages your mailboxes sent through our mail server. Mail you receive is not shown here; for that, look in the mailbox itself (webmail or your mail client). Each row has:

• Time – when the message was handed to the mail server.
• Sender – the mailbox that authenticated and sent the message.
• From – the envelope sender address on the message (usually the same as Sender, but can differ, for example when sending through an alias).
• To – the recipient address.
• Spam Score – how spam-like the message looked to an automated check at send time. This is informational only: outgoing mail is never blocked or held back because of its score, so a high score by itself does not explain a failed delivery – it only means the message looked risky and is worth a second look (for example, an unexpected recipient list, or an account whose password may have leaked).
• Result – Queued (accepted by our mail server and handed on), Deferred (delivery is being retried; the receiving server asked us to try again later), Rejected (the receiving server refused the message), or Unknown.
• SMTP Response – the raw response text from the receiving mail server, visible on wider screens. This is where the actual reason for a bounce or rejection shows up (for example a "mailbox full" or "message rejected as spam" message from the recipient's provider).

Answering "did my e-mail get delivered, and if not, why"

Find the message by time and recipient. Queued means our mail server accepted it and passed it on to the recipient's mail server – this is the same as pressing send successfully, it does not guarantee the recipient's own server accepted it for the mailbox. A Rejected or repeatedly Deferred result, together with the SMTP Response text, tells you what the recipient's mail server actually said – most bounce reasons (unknown mailbox, mailbox full, message flagged as spam by the recipient) come from there, not from our side.

Auth Logs – what it shows

Auth Logs list every login attempt to your mailboxes, successful or not. Each row has:

• Time
• Mailbox – the address the login attempt was made against.
• IP Address – where the attempt came from.
• Protocol – IMAP, POP3 or Submission (the protocol used to send mail).
• Result – Success or Failure.

You can filter the list by Mailbox, Protocol, Result and a date range (From / To).

Answering "who logged into my mailbox"

Filter by the mailbox and look at the IP addresses and times of successful logins – an address or a time you do not recognise is worth investigating. A run of Failure results from IP addresses you do not recognise, especially against several mailboxes at once, usually means someone is guessing passwords rather than a real user mistyping theirs; if you see that, change the affected mailbox's password. See Mailboxes for how to reset one, and Setting up a mail client if the protocol and server settings in a failed login look unfamiliar.

How current the data is and how far back it goes

Both logs are updated in the background roughly every 15 minutes, so a message you just sent or a login that just happened may take a few minutes to appear. Entries older than 90 days are removed automatically.

Who can see these logs

The hosting's owner and anyone added as a collaborator on that hosting can open Delivery Logs and Auth Logs. Each hosting only ever shows its own data.

Related

If a mailbox password did leak and someone is sending through it, the sending limit on that mailbox is what stops it from turning into a flood. For reports about mail sent as your domain by other, external mail systems, see DMARC reports.