Supported editions for this feature: Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus. Compare your edition
You can see how many messages Google’s spam filter marked as spam during a specific time period by viewing the spam filter report in the security dashboard. There are 3 versions of the spam filter report:
- All—You can see whether incoming messages are going to user inboxes or being routed as spam.
- Phishing—You can also see how phishing emails are routed.
- Malware—You can see messages marked as malware and when.
View the spam filter report
-
Sign in to your Google Admin console.
Sign in using your administrator account (does not end in @gmail.com).
-
In the Admin console, go to Menu
Security
Security center
- Scroll to Spam filter - All, Spam filter - Phishing, and Spam filter - Malware and in the lower-right corner of a card, click View Report.
Interpret the data
Display the spam filter as a graph
If a message is considered suspicious but also has positive qualities—say the sender is on your allowlist—it can be placed in a user's inbox. You can see messages that were delivered to a user’s:
- Inbox—Includes suspicious messages that were placed in users’ inboxes because the sender is on your allowlist
- Spam folder—Includes messages identified as spam, phishing, or malware by the Gmail spam filter
Tip: You can hide lines in the graph by clicking on the legend. For example, click Spam to hide this line in the graph. This is especially useful if one line overlaps another.
Using the lists above the graph, you can view data from all of your domains or from specific domains. You can also customize the graph to provide details only about certain types of messages:
| Filter | Description |
|---|---|
| Time classified |
Pre-delivery—Messages with attachments confirmed to be malware before they are delivered are placed in the user’s spam folder, with the attachments disabled. |
| Traffic source | All—Both internal and external messages External—Sent by users outside of your domain Internal—Sent by users inside of your domain |
|
Classification |
All—All messages |
| Domain | Choose the domain for your report. |
| Date range |
Customize the report to view data from today, yesterday, this week, last week, this month, last month, or days ago (up to 180 days); or enter a start date and end date. Click Apply after you set the date range. For this report, data is displayed only for the last 30 days. For example, if you set the parameters for up to 60 days, the data in the report is cut off at 30 days. |
To generate a spreadsheet with the graph’s data to Google Drive, click Export Sheet.
Focus on data points in the table
To get more detailed information about spam messages sent on a particular day, click the point on the graph for that date. Details about those messages appear in the table below the graph.
Click a tab above the table to see more data on the selected messages, including:
- Subject
- Recipient
- Sender
- IP Address
- Spam classification reason
- Sender Domain
- SPF and DKIM Domains
- SHA 256 Attachment Hash
- Attachment File Extension
- Display Name of sender
To see all the available message data, scroll left or right on the tabs.
Note: Long and unreadable attachment file names are truncated in spam filter tables.
Compare current and historical data
To compare the current data to historical data, in the top right, from the Statistical analysis menu, select Percentile (not available for all Security dashboard charts). You’ll see an overlay on the chart to show the 10th, 50th, and 90th percentile of historical data (180 days for most data and 30 days for Gmail data). Then, to change the analysis, at the top right of the chart, use the menu to change the overlay line.
