Last updated:

Email as evidence: sent is not received

A screenshot of the Sent folder does not prove that an email arrived. Compare it to a photo of a letter going into the postbox: it shows that the letter was posted, not that it arrived. That is what registered mail with an acknowledgement of receipt is for.

The route of an email

An email passes through four steps, and each step leaves traces in a different place.

Chain of evidence of an email Four steps: composed and sent in the sender's email client, relayed by the outgoing server, accepted by the receiving server, delivered to the mailbox. A screenshot of Sent shows only the first step. 1. Sent sender's email client 2. Outgoing server sender's provider 3. Accepted "250 OK" from recipient 4. Delivered recipient's mailbox what a screenshot of Sent shows where the proof of delivery is: the sender's logs The Message-ID is also created in step 1, by the sender's own client.

A screenshot or printout of Sent shows only the first step: there was a message in the sender’s email client. The Message-ID does not prove delivery either, because the sender’s own client creates it.

Where the evidence is

In the logs of the sender’s outgoing mail server. They show whether the recipient’s server accepted the message. With Gmail that reply looks like 250 2.0.0 OK … - gsmtp.

Those logs are not kept for long:

  • Microsoft 365: message trace, up to ninety days back (Microsoft Learn).
  • Google Workspace: Email Log Search, thirty days (Google Workspace admin help).
  • Your own server or hosting: the mail server logs, often only a few weeks.

If the dispute comes only months later, they are often gone already. If they still exist, have the provider retrieve them, not the sender. Also ask for the original message as .eml (in Gmail: Show original). It contains the Message-ID, the route and the authentication, which a printout does not show.

On the recipient’s side

With a free Gmail account you cannot conclusively prove that an email never arrived. A search across all folders, including Spam and Trash (in:anywhere, or rfc822msgid: if the Message-ID is known), and a Google Takeout with a hash support the claim. But a deleted message cannot be told apart from a message that never arrived.

Buying Google Workspace afterwards does not help. Workspace works with your own domain and new accounts, and the logs only begin at activation. For a free account you obtain Google’s logs only through a judicial order.

Checking a screenshot or printout

If there is only a scan of a printout, you have at least the third generation of the original. Looking for traces of editing at pixel level is pointless then. You can check whether the documents agree with each other and with how the email client works.

Ask for the document itself. Confidential details may be blacked out, as long as the date and time, the recipient’s address and the Message-ID stay readable. Then check:

  • Is the recipient’s full address on it, or only a first name? If the recipient has several addresses, a first name does not say which address the email went to.
  • Does the date fit the moment of the screenshot? On screen, Gmail shows only the hour for a message from today, and from the next day on also the day and the date. A printout always shows date and time, so this test only applies to a screenshot.
  • Does the counter add up? At the top of an opened message in Sent it says “1 of” followed by the total. Gmail gives the most recent message number 1. If the screenshot was taken later and another email went out in the meantime, it can no longer be number 1.
  • Is the attachment on the printout? Gmail prints attachments at the bottom, with name and size. If the email mentions an attachment and none is on the printout, the printout was shortened or it is a different message.
  • Is everything in the same language? In a Dutch-language Gmail the bar above an attachment reads “Eén bijlage • Gescand door Gmail”. An English bar in an otherwise Dutch screenshot is something someone has to be able to explain.
  • Do two printouts of the same message have the same formatting? A Gmail printout keeps formatting and colour. A difference in bold can be down to the scan, though.

Check each point with your own test in the same email client, and note which kind of account, in which language and when you tested. Gmail changes. That way anyone can repeat your tests, and that is what makes them strong.

Describe what you find as contradictions the sender has to explain, not as proof of forgery. You cannot demonstrate the latter from a scan.