Use Zoho's administration reports to answer a specific question, such as who changed a forwarding setting or why a message was not delivered. Mail logs describe message handling; audit logs describe administrative activity. They are different evidence sources.
IN THIS ARTICLE
01 Investigate a change
- Record the affected account, the observed problem and the earliest known time. Include the time zone.
- Sign in with an authorised reporting role and open Reports in Zoho Mail Admin Console.
- In Admin Reports, open Logs > Audit logs > Admin activity for administrative changes. For message delivery, use Logs > Mail logs > Delivery logs instead.
- Select the Date window and relevant Event Category. Use Performed by for the administrator who acted and Performed for for the affected user. Search the available categories for a term such as forwarding when the exact event category is unclear.
- Inspect the event description, time, actor and client IP. If an export is required and permitted, use Share > Download, choose the intended loaded or full result scope and Schedule export. Keep the completed CSV in restricted storage.
02 Interpret carefully
An administrative record can establish that a particular account performed an action, but it does not alone establish the human's intent or whether that account was compromised. Compare the event with the approved change request and account security information.
For delivery, record the original sender, recipient and message identifier. A similar subject is insufficient when retries or multiple copies exist. Check the final outcome and any error detail before changing a routing policy.
Why might a Zoho audit search show no matching record?
Confirm organisation, time zone, permission and report availability. Retention and export capabilities vary; the absence of an old entry is not proof that an event never happened. Capture evidence promptly while it remains available.
When escalating to us, provide the narrow incident window and sanitised relevant records. Avoid a full-organisation export if a few entries answer the question. If an unauthorised change is confirmed, secure the responsible account and reverse the specific change after preserving enough information to understand its effect.