How to Trace Email Delivery in cPanel with Track Delivery

When an email does not arrive, arrives hours late, or you cannot tell whether it ever left the server, cPanel's Track Delivery tool answers the question without a support ticket. It shows what the mail server did with each message — accepted it, queued it, handed it to the recipient's provider, or rejected it — and it quotes the reason, usually in the recipient's own words.

This article covers running a report and reading what comes back. For the failure messages themselves, its companion cPanel Email Delivery Errors is a lookup table of the error text you are likely to see.

What Track Delivery Covers

Track Delivery reads cPanel's eximstats database, which the mail server populates as it handles messages. Three consequences shape everything else:

• It covers both directions. The table lists the most recent messages sent to and from your cPanel account's mailboxes, including every delivery success and failure.
• It only knows what this server handled. If a message never reached the server, there is no row to find. An empty result for an incoming message means nothing arrived here — not the server blocked it.
• It does not remember forever. Old records are pruned on a schedule your hosting provider sets. cPanel's default is 10 days (the setting allows anything from 1 day upwards), so act quickly on older incidents. Check the fine print beneath the Delivery Report table for the window that applies to your server.

Note: If the report contradicts a bounce message you received in writing, trust the bounce. cPanel warns that on a server running third-party mail filtering such as MailScanner, "this feature will return invalid results." Send us the bounce and we will check the raw mail logs.

Trace It: Running a Delivery Report

Step 1: Log in to cPanel

Navigate to yourdomain.com/cpanel or log in through the Cynet client area at manage.cynet.com.my. See How to Log In to cPanel if you need the details.

Step 2: Open Track Delivery

Scroll to the Email section of the cPanel home page and click Track Delivery.

If you cannot find the tile, search for either Track Delivery or Email Trace in the cPanel search box at the top of the page — Email Trace is the name the same feature carries in WHM's Feature Manager, which is where your hosting provider can switch it off.

The page opens with a report already populated: recent messages for your account, newest first, sorted by Sent Time.

Note: If the tile is genuinely absent, or the table is present but permanently empty, contact Cynet support. An empty table can mean the statistics service that feeds the report is not running, which is something only we can check.

Step 3: Search for a Specific Address

Type the address you are chasing into the Recipient Email (optional) box and click Run Report.

The Delivery Report section reloads, and the line beneath its heading updates to read The search matches N records. A second section headed Email Address Trace appears below the table; that is a routing diagram rather than a history, and it is explained further down.

To clear the search, empty the box and click Run Report again. The table resets to the full recent list, but the Email Address Trace diagram does not reset — ignore it once you have moved on.

Note: The box filters on the recipient. To find a message by who sent it, leave the box empty and scan the From Address column instead.

Step 4: Narrow the Report Down

Two report-scope options sit below the search box. Show All displays every delivery; Show Blocked & Failed filters the table down to delivery failures only. Choose Show Blocked & Failed when you already know something went wrong and want the noise gone, and Show All when you need to prove a message was delivered, or do not yet know whether it left.

Inside the Delivery Report panel are four checkboxes, all ticked by default:

• Show Successes
• Show Deferred
• Show Failures
• Show In-Progress

Below them, the Max Results/Type: menu is set to 250. As the name says, it caps results per event type, so raising it returns more successes and more failures. Raise it if you are looking further back than the last few hundred messages, and use the paging controls at the top right of the panel — a page selector and a Show N Results menu — to move through what comes back.

Warning: There is no date or time filter in cPanel's Track Delivery. Guides that tell you to set a start and end date are describing WHM's Mail Delivery Reports, a different interface only your hosting provider can open. On the cPanel side you narrow by recipient, by event type and by result count — that is all.

Step 5: Open a Single Message in Full

The last column of every row is Actions, holding a blue circular information icon. Click it.

A panel headed Delivery Event Details opens, listing every recorded field for that one message, with Print and Close buttons. This is the fastest way to see routing and timing detail without widening the table, and it is what you copy from when you escalate.

Usefully, this panel spells the outcome out as a word — Event: success — where the table cell shows only an icon.

Step 6: Add the Columns You Need

The default columns hide most of the diagnostic detail. Click the table options icon at the top right of the Delivery Report panel to open the column picker, then tick the columns you want.

For chasing a delivery failure, add Router, Transport, Delivery Host, Delivery IP Address, Out Time and ID. For working out who or what sent a message, add User, Authentication and Sender IP Address.

Read It: The Event Column

The Event column contains an icon and nothing else — no status word is printed in the cell. cPanel documents seven states. Note that the icon legend uses the word Error where the filter checkbox says Show Failures; they mean the same thing.

Warning: Success means the message left this server and the next server accepted it. It does not mean the recipient's provider put it in the inbox, and it certainly does not mean anyone read it. A message can be logged as Success here and still sit in a Gmail spam folder.

Read It: The Result Column

Result is the most diagnostic field in the report. cPanel defines it only as "a message that describes the delivery results," because the text is not cPanel's — it comes straight from the mail server, and often quotes the recipient's server verbatim.

On a successful delivery it usually reads simply Accepted. On a failure it carries the reason, and the single most useful thing in it is the three-digit code: 4xx codes are temporary, so the message is still queued and will probably arrive, while 5xx codes are permanent, meaning the message is gone and has bounced.

For the full lookup — what each error string means and what to do about it, from Unrouteable address to Gmail's 550 5.7.26 and Microsoft's S3150 block — see cPanel Email Delivery Errors.

Note: Long replies from remote servers can appear cut off in Result, because the stored failure text is length-limited. If a string ends mid-sentence, quote what you can see and tell us it was truncated — we can retrieve the full line.

Read It: The Spam Score Column

Spam Score is the message's Apache SpamAssassin score — an open-ended point total built from the spam-related traits found in the message. It is not a percentage and not a mark out of ten. Higher is worse, and negative scores are possible.

The conventional reference point is 5, SpamAssassin's own default. The threshold that actually applies to your incoming mail is the Spam Threshold Score you set in cPanel's Spam Filters. If a message meets or exceeds it, the message is marked as spam — and if Automatically Delete New Spam (Auto-Delete) is enabled, it is destroyed rather than filed. See How to Adjust Spam Filter Sensitivity, and How to Whitelist an Email Address for senders you never want scored out.

Warning: A high Spam Score on an incoming message plus Auto-Delete enabled means your own configuration deleted the message. No investigation on our side can recover it. Use Move New Spam to a Separate Folder (Spam Box) instead of auto-delete if you want a safety net.

• Outgoing mail is usually not scanned. Outbound spam scanning is off by default, so most outbound rows carry no score at all.
• The message was too large. SpamAssassin skips messages above a size threshold, because spam is typically small.
• The mail came through a trusted relay, which is not scanned.
• Spam filtering is switched off for the account or the domain.

Read It: Every Field in the Report

The table opens with a small default set of columns — Event, From Address, Sent Time, Spam Score, Recipient, Result and Actions — and some versions include Sender. Everything below is available either as a column or in the Delivery Event Details panel.

Note: There is no subject line anywhere in Track Delivery — not in the table, not in the detail panel — and no message body. Track Delivery records deliveries, not content. Identify messages by recipient, time and ID instead.

The Email Address Trace Diagram

When you run a report with an address in the box, a section headed Email Address Trace appears below the table. This is not history. cPanel describes it as showing "how the system sent or would send an email message to the given email address."

In other words it answers a different question: given the current configuration, where would mail to this address go? That makes it the right tool for diagnosing forwarder chains and routing loops even when no message has been sent. Its icons are a separate vocabulary from the Event column — local delivery, remote delivery, defer, reject, error, received and discarded — and cPanel notes that "these icons may vary from those that your system uses."

Use it alongside Email Forwarding when mail to an address is disappearing rather than bouncing.

Timezones: Always State Yours

This trips up almost every escalation. Track Delivery renders times in your browser's timezone, not the server's — cPanel states this explicitly for both Sent Time and Out Time.

Our support team reading the raw mail log sees the server's timezone. A ticket saying "the message was sent at 3:42pm" therefore sends us hunting in the wrong window, and if you are travelling or on a VPN, your browser's timezone may not even be the one you assume.

Note: Always state the timezone when you quote a timestamp — "3:42pm MYT (UTC+8)". Better still, quote the message ID, which is timezone-proof.

What Track Delivery Cannot Tell You

Knowing the limits saves a wasted ticket.

• Mail that never reached the server. No row means nothing arrived. Look at the sender's bounce message and your domain's MX records next, not at cPanel.
• Mail that bypassed the server. If your domain's MX records point at Google Workspace or Microsoft 365, incoming mail for that domain never touches this server, and mail you send through their servers is equally invisible. Use the provider's own message trace instead.
• Subject lines or message content. Neither is recorded.
• Anything outside the retention window, which defaults to 10 days. The raw mail logs are separate, root-only, and rotate on their own schedule.
• Whether a message was read, or even reached an inbox.Success is a hand-off to the next server; what that server did afterwards is invisible here.
• Other accounts' mail. The report is scoped to your own account's mailboxes. The server-wide view is a WHM tool we run for you.
• Retrying, releasing or deleting queued mail. That needs WHM's Mail Queue Manager. Ask us.
• Which script sent a message, unless origin tracking was enabled server-side beforehand. If you are hunting script-generated spam, ask us to enable it before the next incident.

Worked Examples

Example 1: Invoices to a Gmail Customer Never Arrive

Symptom: Emails to [email protected] vanish. No bounce noticed.

1. Open Track Delivery, enter [email protected] in Recipient Email (optional), and click Run Report.
2. Two rows appear, both with the Error icon — so these are permanent failures. The mail is gone, not delayed.
3. Click the information icon in Actions. Result shows a 550 5.7.26 rejection stating the sender is unauthenticated.
4. A remote host and IP are named, so Gmail spoke; the failure came after the message body was sent, so it is not a bad address; and 550 is permanent.
5. Conclusion: your domain is not authenticating. Fix it at your end by repairing your SPF and DKIM records, then send a test and confirm the new row shows Success.

Example 2: A Supplier Insists They Emailed You

Symptom: A supplier says they sent a purchase order yesterday. It is not in your inbox or your spam folder.

1. Leave Recipient Email (optional) empty, choose Show All, and scan the Recipient column for your own address around the time given — allowing for the timezone difference between you and them.
2. A row with the Filtered icon means the server accepted the message and local filtering then diverted or discarded it. Check the spam folder again, then audit Spam Filters — particularly Automatically Delete New Spam (Auto-Delete) — and Email Filters. If the score was above your threshold and auto-delete was on, the message is unrecoverable; raise your threshold or switch to Spam Box, per Adjust Spam Filter Sensitivity.
3. A row with the Rejected icon means the server refused it during the SMTP conversation, so the supplier received a bounce. Ask them for it — the bounce names the reason.
4. A row with the Error icon and a mailbox-full result means your mailbox or account is out of space. Clear it and see Fix: Disk Quota Exceeded. Disk usage figures are cached, so delivery may keep failing for a while after you free space.
5. No row at all means nothing reached this server. Ask the supplier for their bounce message and verify your domain's MX records point here. This is the outcome customers most often misread as "the server blocked it."

Example 3: A Newsletter to 300 Addresses Stalls Halfway

Symptom: Half the recipients got it, the rest did not, and sending appears to have stopped.

1. In Track Delivery, untick Show Successes so only problems remain.
2. Rows with the Deferred icon and a 421 result are rate limits at the recipient's provider — still queued, still likely to arrive. Do nothing.
3. Rows with the Error icon mentioning exceeded the max defers and failures per hour are your own server stopping you, because too high a proportion of the send failed. Those messages are gone, and the block clears at the top of the next hour.
4. Conclusion: the list contains dead addresses whose bounces tripped the failure-ratio limit. Remove the addresses that returned 550 5.1.1 and similar, and move bulk sending to a dedicated mailing service — see the prevention notes in Fix: Outgoing Mail Hold.

What to Send Us When You Escalate

If the report shows a failure you cannot act on, open a ticket at manage.cynet.com.my. Click the information icon on the affected row first and copy these fields out of the Delivery Event Details panel:

• ID — quote it exactly; it lets us pull the full transaction from the raw mail log.
• Result — the verbatim failure text including the three-digit code. Say so if it looks truncated.
• Event — which status the row shows.
• Sent Time and Out Time — with the timezone stated, since these are shown in your browser's timezone.
• Recipient and From Address — the two ends of the delivery.
• Router and Transport — these tell us instantly whether delivery was local or remote.
• Delivery Host and Delivery IP Address — which mail exchanger was tried.
• Spam Score — relevant to anything filtered or spam-related.
• Sender IP Address and Authentication — needed for any "who sent this?" or suspected-compromise question.

We can then check the server-wide delivery report, read the raw mail logs, inspect and retry queued messages, release outgoing mail holds, and request delisting from providers that have blocked the server's IP.

Frequently Asked Questions

Does the green Success icon mean the recipient received the email?

No. It means the server handed the message to the next server successfully. Whether the recipient's provider then delivered it to the inbox, filed it as spam, or applied a rule of its own is not visible from here.

My message is missing from the report entirely. Why?

Four common reasons: it is older than the retention window; it is beyond the Max Results/Type cap, so raise the limit or page through the results; it never reached this server; or mail for that domain is handled elsewhere because the MX records point at another provider.

A message shows as Deferred. Can I force a retry?

Not from cPanel. Retries happen automatically for about four days. If it is urgent, open a ticket and ask us to attempt delivery from the mail queue.

Where do I find Track Delivery if the tile is missing?

Search for Track Delivery or Email Trace in the cPanel search box. If nothing comes back, the feature has been disabled for your account — open a support ticket and we will check it, along with the statistics service that feeds it. For a general tour of the control panel, see cPanel Basics and Managing Email Accounts in cPanel.