Collapse
Submit a Service Request
Contact Information for Technical Support
My Service Notifications
Creating and using a report to search mail_hdr
Answer ID 13028 |
Last Review Date 07/25/2025
How can I search mail headers to find a missing email?
Environment:
Incoming Email, Analytics
Issue:
Email-sourced incidents cannot be found - we have SMTP forwarding to Oracle-hosted mailboxes and the emails were delivered, but I cannot find the incident.
Resolution:
Use the threads.mail_hdr field to search for missing emails that create or update an incident. The Mail Header has unique information that is specific to each email, such as the Message-Id. Searching mail_hdr field can help find incidents when more basic searches based on incident subject or contact email don't provide the incident for the 'missing' email.
For help creating a basic report please refer to Answer ID 2509: Creating a basic custom report. Some suggestions for creating a report to search Mail Headers are listed below:
- Database tables to include in a report:
- incidents with inner join to threads
- Columns to include in a report might include:
- incidents.ref_no
- incidents.subject
- threads.entered ***incidents.created can also be included, but a threads.entered column will be helpful for the mail_hdr search results
- threads.mail_hdr *** consider formatting this column with 10,000 (or more if needed) characters to see the full email header, and the "Display 'more' link when text width exceeds cell width"
- Several filters are needed because the threads table tends to be large. Other filters can be added as desired, but these filters should be set as required (and optionally docked):
- threads.mail_hdr with Operator like
- threads.entered with Operator between or some other appropriately limiting date range.
Tips for using the threads.mail_hdr filter:
- When using the report with a mail_hdr 'like' operator search filter, use a wildcard (%) around your search value (Answer ID 1744: Values of the Operator field when configuring report filters).
- If you know the Message-Id of the email, then entering the Message-Id may provide the most specific and helpful result.
- If you don't find the incident thread with the Message-Id, then try searching the email subject or contact email. Some mail_hdr have elements that are encoded, which can impact the search - view other mail headers on your site so you know what to expect. Starting with something specific and broadening the search is a best practice.
Notes:
EGW_SAVE_EMAIL_HEADERS = Yes is required. If set to No then threads.mail_hdr database field is Null.
This report can help find incidents when some email details are known, such as Message-Id or Subject. If an email is filtered, there will not be a threads.mail_hdr relevant to the 'missing' email, so a next step is to check filtered emails (Answer ID 5670: Techmail message filters explained).
