Delivery status, SMTP response codes, bounce classification and timestamps for every email you send. This page also explains how to read them — what a 421 means, why a deferral isn't a failure, and why "delivered" doesn't mean "in the inbox".
Email logs are the per-message record of what happened to each email your system sent: when it was queued, which receiving server accepted or rejected it, the SMTP response code returned, whether it bounced or was deferred, and any opens or clicks afterwards.
The distinction that matters is between sent and arrived. Your application knows it handed a message off. Only the log knows whether Gmail accepted it, whether Microsoft deferred it three times before accepting, or whether it was rejected with a 550 because the address stopped existing eight months ago.
Without logs, a user reporting "I never got the OTP" is unanswerable. With them, it takes about thirty seconds.
These get conflated, and the difference is worth being precise about.
Analytics tell you something is wrong. Logs tell you what. A bounce rate rising from 2% to 9% is an analytics observation; discovering that it's entirely one domain returning 554 policy rejections is a log finding. See email analytics for the aggregate side.
Every delivery attempt ends with a numeric response from the receiving server. The first digit carries the meaning, and it's the single most useful thing to know when reading SMTP logs.
250 is the one you want to seeThe codes you'll actually encounter:
A note on 554: it is the code that most often indicates a reputation problem rather than a bad address. If 554s cluster around one provider, the message text alongside the code usually names the reason — a blocklist, failed authentication, or content filtering.
Three outcomes that get treated as one thing, with very different implications.
Hard bounce. Permanent. The address doesn't exist, the domain doesn't resolve, or the server rejects it outright — typically a 5xx code. That address must be suppressed and never mailed again. Continuing to send to hard-bounced addresses is one of the fastest ways to damage sender reputation, because mailbox providers read it as a sender who doesn't maintain their list.
Soft bounce. Temporary. Full mailbox, server problem, rate limit — usually 4xx. The message is retried on a schedule. A soft bounce that persists across many attempts eventually converts to a hard bounce.
Deferral. The receiving server asking you to slow down. Also 4xx, and this is the one people misread as failure. A message deferred and delivered twenty minutes later reached the recipient. Occasional deferrals are entirely normal, particularly from Microsoft and during volume ramps.
What matters is the pattern rather than the individual event. A sustained rise in deferrals against one provider is a reputation or volume signal worth acting on; a scattering of them across a large send is just how email works.
The most common real use of logs: a customer says an email never arrived, and you need the email trail for that one message.
A per-message timeline in neuMails runs:
Search by recipient address, subject, campaign, status or date range. Every entry shows the receiving server's actual response text rather than a generic "failed" label — which is usually where the answer is.
Worth being straightforward about the limit, because it causes real confusion.
"Delivered" does not mean "in the inbox." It means the receiving mail server accepted the message. What happens next — inbox, promotions tab, spam folder — is decided by the provider's filtering, and that decision is not communicated back over SMTP. No email log from any provider can see past the point of acceptance.
This is why a campaign can show 99% delivery and still perform badly. The mail arrived; nobody saw it.
Closing that gap requires seed list testing — sending to monitored accounts across providers and observing which folder the message lands in. Logs and seed testing answer different halves of the same question.
Open tracking has its own limitation: Apple Mail Privacy Protection pre-fetches images, so a meaningful share of recorded opens never involved a human. Treat opens as directional, and weight clicks instead.
A rough diagnostic order when delivery degrades:
If the pattern points at authentication, our SPF, DKIM and DMARC wizard will show you whether records are correct and aligned.
If you need history beyond the searchable window, webhooks are the right mechanism: capture events into your own database as they happen rather than relying on retrieval later. That also keeps your suppression state in sync, which matters because your platform suppressing a bounced address doesn't stop your application from queueing another send to it.
Log data is stored on AWS Mumbai (ap-south-1) alongside the rest of your account data. See DPDP compliance for the residency picture, or on-premise deployment where logs must remain inside your own network.
Full per-message logs on every plan. Free trial, no credit card required.
Start Free TrialThe per-message record of what happened to each email your system sent — when it was queued, which server accepted or rejected it, the SMTP response code, whether it bounced or was deferred, and any opens or clicks. They're the difference between knowing an email was sent and knowing whether it arrived.
Analytics aggregate: open rate, click rate, bounce rate across a campaign. Logs are per-message: this email to this address at this timestamp got this response. Analytics tell you something is wrong; logs tell you what.
The first digit carries the meaning. 2xx means accepted. 4xx is transient — try later, and the message is retried. 5xx is permanent — rejected outright, and retrying won't help.
Hard is permanent: the address doesn't exist or is rejected outright, usually 5xx. Suppress it and never mail it again. Soft is temporary — full mailbox, server issue, rate limit, usually 4xx — and is retried automatically.
Not individually. A deferral is a server asking you to slow down, and a message deferred then delivered twenty minutes later reached the recipient. Watch the pattern: a sustained rise against one provider signals a reputation or volume problem.
10 days searchable on all plans, with CSV export for longer archival and API access for retrieval. Extended retention is available on request for audit or compliance requirements.
Yes — CSV export and programmatic API access. Webhooks push delivery events into your systems in real time, which is the recommended approach if you need retention beyond the searchable window.
Delivered means the receiving server accepted it. Where it went next — inbox, promotions, spam — is the provider's filtering decision and isn't reported back over SMTP. Inbox placement testing is what reveals that.