> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/fundamentals/explore/message-search.md).
# Message Search
With Message Search, you can search for messages across all enabled mailboxes in real-time and take bulk actions on the results.
### About Message Search
With Message Search, you can search for messages across all mailboxes that Material syncs, in real time. Depending on your role, you can view message metadata or contents for the results, and take bulk actions such as deleting or tagging messages.
All search queries are logged and can be reviewed on the [Audit Log](/learn-more/administration/audit-log.md) page in the Admin Console. Currently, all searches operate using exact substring matching.
### Search Functionality
Message Search supports any combination of the following keywords to filter search results. The search applies `AND` logic between consecutive keywords, and negates any keyword prefixed with `-` (for example, `-from:person@company.com`). Separate search operators with a space.
| Operator | Description |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `body` | Specify text within the full, untruncated raw message body |
| `snippet` | Specify text within a truncated version of the message body. This may have HTML elements stripped out, depending on the mail provider |
| `attachments` | Specify the message attachment name |
| `attachmentName` | Specify an attachment name |
| `filename` | Specify the message attachment name |
| `links` | Specify a link URL |
| `linksText` | Specify display text found within HTML anchor tags |
| `to` | Specify the message to field |
| `cc` | Specify the message CC field |
| `bcc` | Specify the message BCC field |
| `from` | Specify the message from field |
| `subject` | Specify the message subject |
| `before` | Specify the latest message date |
| `older` | Specify the latest message date |
| `after` | Specify the earliest message date |
| `newer` | Specify the earliest message date |
| `spf` | Specify the SPF result. Possible values are: pass, none, neutral, temperror, permerror, softfail, policy, fail |
| `dkim` | Specify the DKIM result. Possible values are: pass, none, neutral, temperror, permerror, policy, fail |
| `dmarc` | Specify the DMARC result. Possible values are: pass, none, temperror, permerror, fail |
| `hasAttachment` | Specify whether the message has an attachment |
| `hasAttachments` | Message contains attachments |
| `attachmentMimes` | Specify an attachment MIME type |
| `hostTags` | |
| `label` | Specify the message label (Google Workspace specific) |
| `category` | Specify the message category (Microsoft 365 specific) |
| `message.status.is\_inbox` | Specify if the message is in Inbox |
| `message.status.is\_unread` | Specify if the message is unread |
| `message.status.is\_draft` | Specify if the message is a draft |
| `message.status.is\_sent` | Specify if the message is in Sent |
| `message.status.is\_spam` | Specify if the message is in Spam |
| `message.status.is\_trash` | Specify if the message is in Trash |
| `message.status.is\_surge` | Specify if the message is held by Email Bomb Protection (applies to messages processed after version 1.57) |
| `hId` | Specify the message id |
| `msgId` | Specify the message id |
| `rfc822msgid` | Specify the message id |
| `hostMsgId` | Specify the message id |
| `inReplyTo` | Specify the in reply to field |
| `replyTo` | Specify the reply to field |
| `isApproved` | Specify if the access request is approved or not |
| `caseId` | Specify an email threat issue ID |
| `xMailer` | Specify the X-Mailer that indicates what email client sent the email |
| `acctEmail` | Specify an account email. Searches across to, from, CC, and BCC fields |
| `uAcctId` | Specify an uAcctId to search for |
| `message.recipients.count` | Specify the number of recipients across the To, Cc, Bcc, and Delivered-To fields. Supports numeric operators such as `>`, `<`, and `=` |
### FAQ
**Who can search messages?**
Review [Admin Roles](/learn-more/administration/admin-roles.md) to identify what roles can view messages and to what extent (or try the search assistant to the right of the search bar on this page).
**What counts as message metadata for Message Search?**
Message headers including subject and recipient information are considered part of the message metadata. The body, snippet, attachments, and attachment names are not included in the message metadata and require elevated permissions to search and view.
**Why is a message that is present in a mailbox not showing up in Material's search results?**
Messages are only searchable for a given account when both the Account Connection and Mailbox Syncing settings are enabled for it.
**How do deleted messages or deleted accounts affect message search?**
Whether deleted messages or messages from deleted accounts remain searchable depends on Mailbox Mirroring. By default, Material retains message metadata even after a message is permanently deleted. In that case, deleted messages can still appear in results.
**What logical and/or grouping operators are supported?**
You can combine the `AND` and `NOT` logical operators to perform searches today (the search applies `AND` logic between consecutive keywords and negates those prefixed with `-`). Currently, Material doesn't support grouping sets of keywords or using an `OR` operator.
For more complex search queries that you can't easily write using a combination of `AND`s and `NOT`s, contact your Material representative about additional query options.
**How far back can I search emails in Material?**
While the historical data is available indefinitely, there are practical search limitations. Material allows searching one year at a time through the UI, though you can go back as far as your email environment extends by adjusting the date ranges.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/getting-started/fundamentals/explore/message-search.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.