Missing Email Investigation Checklist

An expected email may be in Junk, quarantine, another folder or a different mailbox. It may also have been rejected, moved by a rule or never successfully sent. Use this checklist to identify what happened before changing spam or phishing protection.

Step 1 — Collect the details

• □ Exact sender address
• □ Exact recipient address
• □ Date sent
• □ Approximate time and time zone
• □ Subject line
• □ Attachment name (if applicable)
• □ Message ID (if available from sender logs or headers)
• □ Non-delivery report (if received by sender)
• □ Sending platform or service

Step 2 — Check the mailbox

• □ Search all folders by sender address, subject and approximate date
• □ Check Junk or Spam — use “Not junk” or “Not spam” rather than simply moving it
• □ Check quarantine through the approved portal or notification
• □ Check Deleted Items
• □ Check Archive
• □ Check Focused Inbox, Other, Gmail tabs or categories
• □ Check shared mailboxes
• □ Check blocked-sender list
• □ Review inbox rules for unfamiliar or unexpected entries
• □ Review forwarding rules

Step 3 — Confirm the sender

• □ Message left the Outbox (not stuck in Drafts or Outbox)
• □ Recipient address is correct
• □ No non-delivery report was received
• □ Sender has checked their sending logs
• □ Attachment is within size and type limits
• □ Sending account does not show signs of compromise
• □ Sending service or platform is recognised and current
• □ Domain authentication (SPF, DKIM, DMARC) is configured and passing

Step 4 — Trace the message

• □ Receiving service found the message in its logs
• □ Gateway or security service identified
• □ Delivery status identified (delivered, quarantined, rejected, deferred)
• □ Security verdict identified
• □ Applied policy identified
• □ Delivery location identified
• □ Rejection reason recorded if applicable
• □ User or administrator action recorded if applicable

Step 5 — Classify the cause

• □ Delivered normally (check other mailbox locations)
• □ Junk or Spam classification
• □ Quarantine
• □ Spam false positive
• □ Bulk-mail classification
• □ Phishing detection
• □ Impersonation detection
• □ Malware or attachment block
• □ Inbox rule
• □ Mail-flow or transport rule
• □ Third-party gateway decision
• □ Authentication failure (SPF, DKIM or DMARC)
• □ Sending-reputation issue
• □ Incorrect recipient address
• □ Message-size or attachment-type issue
• □ Not received by organisation
• □ Not successfully sent

Step 6 — Correct the cause

• □ Report as not junk or not spam using the platform’s built-in tool
• □ Submit false positive through the platform’s approved submission process
• □ Ask sender to correct authentication (SPF, DKIM, DMARC)
• □ Ask sender to correct sending address or platform
• □ Ask sender to correct routing or sending infrastructure
• □ Remove incorrect inbox rule
• □ Amend incorrect mail-flow or transport rule
• □ Review attachment or URL if flagged by security scanning
• □ Correct gateway policy where applicable
• □ Create targeted exception (see Step 7 before proceeding)
• □ Escalate if supplier compromise is suspected

Step 7 — Review any exception

If a correction requires an exception, confirm all of the following before creating it:

• □ Specific, documented business reason
• □ Narrow sender scope (specific address or authenticated domain — not a whole domain without authentication check)
• □ Narrow recipient scope (specific user or group)
• □ Sender authentication verified
• □ Named owner assigned
• □ Approval recorded
• □ Expiry date set
• □ Monitoring enabled for matched messages
• □ Review date scheduled

Step 8 — Confirm the result

• □ Test message received correctly
• □ Normal message from sender received correctly
• □ Sender authentication passes
• □ Expected attachment delivered
• □ Quarantine behaviour is correct and unchanged for other senders
• □ No broad protection has been disabled
• □ Delivery logs reviewed to confirm expected outcome
• □ User has been informed of the resolution
• □ Incident and corrective action recorded