# What is a corporate email audit log: who, when, which > Email audit logs record mailbox opening, access grants, quarantine, bulk actions, setting changes by person and time. Learn why it matters and how to read it. Source page: https://dblinx.net/en/smartmail/blog/kurumsal-e-posta-denetim-kaydi --- Administration # What is a corporate email audit log: who did what, and when? The audit log is a list of significant actions performed in corporate email, recording who did them and when; it cannot be edited or deleted from the dashboard. It is the first place to look when an email goes missing, someone is granted access by mistake or a rule changes. - [Administration](/en/smartmail/blog/#etiket-yonetim) - [Audit](/en/smartmail/blog/#etiket-denetim) - [Security](/en/smartmail/blog/#etiket-guvenlik) SmartMail team2 min readPublished: 17.10.2026 Shared mailboxes pass through many people's hands. This flexibility makes the question “who did it?” harder when a problem arises. The audit log does not leave the answer to this question to guesswork: every important action is recorded together with the person who performed it and the time. ## What should be kept in the audit log? - Opening, closing and deleting mailboxes - Granting or revoking access for people and departments - Organization-wide rules such as blacklists and whitelists - Quarantining and releasing from quarantine - Bulk operations affecting many emails at once - Approved sending decisions and setting changes ## How to read the audit log? - The newest activities are at the top; the row shows the activity name, the person who performed it and the date. - To view rule and permission changes separately, filter by policy changes; for bulk moves and deletions, filter by bulk operations. - For automatic actions (e.g. automatic quarantine), “System” is shown as the actor. - For older records, continue from the end of the list. **Tip**Review the audit log not only when something goes wrong but also routinely once a month: unexpected access or a rule change can be spotted early. ## How SmartMail solves this - **Audit log screen:** creating and deleting mailboxes, granting access, blocklist and allowlist rules, quarantine, bulk move, approved sending and settings changes in a single list. - **Filters:** All events, Policy changes and Bulk actions; bulk actions also state how many emails were affected. - **Severity bar:** organization-wide rule and permission changes as well as deletions are highlighted separately. - **Permission-restricted:** only administrators with this permission can see the audit log. [Administration and permissions](/en/smartmail/yonetim)[Reviewing the audit log](/en/smartmail/belgeler/yonetici/denetim-kaydi) ## Frequently asked questions Who can see the audit log? Administrators with permission to read the audit log. This permission is granted from the organization's permission settings. Are automatic actions recorded? Yes. For actions performed by the system, such as automatic quarantine, “System” is shown as the actor. Can you see who deleted an email? Deletion and bulk move operations are recorded in the audit log with the person and time; for bulk operations, the number of affected emails is also recorded. ## Try SmartMail with your own mailboxes In the demo account, you can explore every screen with sample data. [Open the demo](https://mail.dblinx.net/demo/)[Buy](https://app.dblinx.net/satin-al?urun=smartmail) ## Related articles - [Security ### How to recognise a phishing email? A phishing email often looks like a familiar sender. You can tell by checking whether the sender really wrote from that domain, letter tricks in the domain, where the link actually goes, and any request for payment or bank details in the email. 4 min read](/en/smartmail/blog/kimlik-avi-maili-nasil-anlasilir) - [Administration ### Email archive and recovery: how to recover deleted mail? A deleted email does not disappear immediately; it remains in the trash for the period determined by the organization and can be restored during that time. For emails that are no longer needed but must be kept, archiving rather than deleting is the right approach: archiving removes the email from the inbox but does not delete it. 2 min read](/en/smartmail/blog/silinen-maili-geri-getirme) - [Team collaboration ### Internal team notes and @mentions: how do you communicate on an email without it reaching the customer? A team note is an explanation left on an email that only the team can see. It does not go to the other party; everyone who sees the same mailbox sees it. When you type a colleague's name with @, they receive a notification; so internal correspondence stays alongside the email without telling the customer “just a minute, let us ask”. 2 min read](/en/smartmail/blog/e-posta-ekip-notu-ve-bahsetme)