No result in Email Log Search does not prove that a message was delivered, rejected or lost. It proves only that the current search did not return a matching record.
Check the search inputs
Confirm the timezone, search window, sender identity and recipient. Applications can expose a visible From address that differs from the SMTP envelope sender. Ask for the Message-ID and the complete SMTP transaction when they are available.
Ask the sender for independent evidence
Collect the application timestamp, destination host, response code and source IP. “The application logged success” is useful evidence about the application, but it is not a Google delivery event.
Separate transport from post-delivery actions
Delivery, quarantine, routing and actions after delivery answer different questions. A message can be accepted and later handled in a way that is not explained by the original SMTP response alone.
Consider another route
The system may use a third-party transport, a local relay or a configuration different from the one the administrator expects. Confirm the actual path before searching more broadly.
Document the gap
A good incident report records:
- what was searched;
- which identities and time windows were used;
- what the sender independently observed;
- which source could provide the next piece of evidence;
- what remains impossible to conclude.
What this evidence can and cannot prove
Email Log Search results describe messages Google logged for the identities and window you searched. A hit does not guarantee inbox delivery; an empty result does not prove loss, rejection or spoofing—it proves only that this search found no matching record.
If the message never appears in Google
Before widening the search, confirm envelope vs visible From, relay vs direct send, and whether traffic uses a third-party route invisible in Workspace admin logs. The next evidence may live in application SMTP traces, ESP activity, or recipient-side tools—not in a broader ELS query alone.
How this differs from a point tool or a DMARC report
Point tools help validate DNS, SMTP or headers for one check at a time. DMARC RUA files answer “who sent mail claiming our domain and how did authentication evaluate?” at aggregate volume—they do not locate one missing message. PunchOp’s hypothesis is a read-only incident investigator that ties available sources together; it does not replace Google’s official log products. See PunchOp vs Email Log Search and SMTP and header point tools.
Sources and limits
Google’s documentation is the technical source for Email Log Search behavior. Public incident R03 illustrates that a missing message can later be associated with quarantine, but one public report does not establish a universal cause.