HEX Logs

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find more information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

Hosted Exchange Logs

The logs in Hosted Exchange help track emails. They show whether a message was accepted, delivered, moved to quarantine or rejected.

The logs are particularly useful for analysing delivery problems, missing emails, spam filter events and rejected messages. They help determine when and how an email was processed.

What Information Do the Logs Contain?

The email logs contain information about incoming, outgoing and rejected emails.

Sender
Recipient
Date and time
Message status
Information about processing by email protection
Detected spam filter checks and security characteristics

Among other things, the logs show whether a message:

was successfully accepted
was delivered
was moved to quarantine
was rejected during transmission

Spam Filter Tags and Check Markers

Additional entries known as check markers or spam filter tags may appear in the logs. These show which checks were performed while an email was being processed.

Such entries do not automatically mean that a message is spam. The spam filter collects various indicators and evaluates them together.

Examples of common check markers:

WEIGHT10, WEIGHT15, WEIGHT20 or WEIGHT30 for spam scoring
PHISHING or PHISHURL for detected phishing characteristics
BULKMAILER for bulk email
OPTOUT for existing unsubscribe links
WEBBUG for detected tracking pixels
SPF, DKIM or DMARC for authentication checks

Many legitimate newsletters contain check markers such as BULKMAILER, OPTOUT or WEBBUG. These entries alone do not mean that a message must be blocked.

When Are the Logs Helpful?

The logs can be used for the following questions:

An expected email has not arrived.
A sent email was not received by the recipient.
A message was intercepted by the spam filter.
An email was rejected and the reason needs to be checked.
It needs to be determined when a message was processed.
Spam filter settings need to be reviewed or optimised.
It needs to be checked why a message was placed in quarantine.

Important Limitation

The email threat protection logs only record communication with external domains. Messages exchanged exclusively within the same Hosted Exchange organisation are not visible there.

Note: If a message within the same Hosted Exchange organisation needs to be tracked, a more extensive technical investigation may be required. In this case, contact Support.

Information Required for an Investigation

If a message cannot be found or its status is unclear, the following information should be provided:

Sender address
Recipient address
Date of the message
Time as accurately as possible
Description of the problem

The more accurate this information is, the easier it is to identify a message in the logs.