When an email is sent to a support email address set up in Freshdesk, it will be received in the customer's mailbox. From there, it will be forwarded to our email service either through auto-forwarding to the forwarding email address or via IMAP, depending on the email address configuration in the Admin section of Freshdesk. Our email service will then parse the email and send it to our product through an API request, which creates a ticket in Freshdesk. Throughout this process, the email will travel through multiple servers before reaching our email service.
If a customer reports a delay in the conversion of their email to a ticket, we need to determine if the delay occurred on :
- Our end or
- During the transit between servers.
To investigate this, we need to analyze the email headers of the specific email in question. To obtain the headers, please retrieve the ticket creation logs of the ticket on which the issue was reported.
- You can obtain the message ID from the email headers of the email from the customer or
- Use search combinations such as :
- "subject" AND "requester_email_address" or
- "backend_ticket_id" AND "INSERT" to find the event ID.
Use the above keywords in the "freshdesk" logset in Haystack and obtain the event ID, Use the Event ID to search again to retrieve the complete ticket creation logs.
Within the logs, you can perform a browser search for the term "Parameters" to locate all the parameters sent by the email service, including the subject, from address, spam info, and more.
If you expand the log, you will find the email headers among the "Parameters" section as highlighted below :
Reading the headers directly from the logs may be challenging, so it's recommended to copy and paste the headers into a text editor for better readability. You can use a software like Sublime and follow these steps:
1. Press CMD+F or CTRL+F, type "\n" > Find all > Enter
2. Press CMD+F or CTRL+F, type "\r" > Find all > Backspace
These steps will remove carriage return and line feed characters, formatting the content in a more readable manner.
The email headers contain various fields such as To:, From:, Subject:, Date:, and useful fields like Message-ID:, Return-Path:, ReplyTo:, X-Headers (added by security devices as the email traverses networks), among others.
For the purpose of analyzing the delay in email-to-ticket conversion, we will focus on the server relay information within the headers.
Each time a server relay receives an SMTP message, it adds a new Received: line at the beginning of the header block. Please refer to the attached file for the complete formatted email headers of the provided example.
Email headers should be read from bottom to top, and each Received: line represents a different hop made by the email.
The final Received: line at the top of the email header indicates
--> The time when our mail server received the email.
In the provided example, it appears in the headers as follows:
-------------------------------------------------------------------------------------------------------------
Received: from mail-pg1-f182.google.com (EHLO mail-pg1-f182.google.com) ([209.85.215.182])
by mxeuc.freshdesk.com (Freshworks SMTP Server) with ESMTP ID 37222468.
for ;
Mon, 11 Oct 2021 14:44:05 +0000 (UTC)
--------------------------------------------------------------------------------------------------------------
In this case, our mail server (mxeuc.freshdesk.com) received the email from mail-pg1-f182.google.com at 14:44:05 on 11th October 2021, UTC, which translates to 22:14:05 IST.
To simplify this analysis, you can use the following tool to analyze the headers: [Tool Link].
[ Before pasting the headers into the tool, make sure to format them using the Sublime editor, as the Google Admin Toolbox may not recognize the headers if directly copied from the Haystack logs. ]
After pasting the headers into the tool and clicking on "analyze," you will see the various hops made by the email and their corresponding timestamps.
From the tool's results, we can see that the email was created at 8:13:51 PM IST on 11th October 2021. The first hop started at 8:14:02 PM IST (11-second delay) and reached mxeuc.freshdesk.com at 8:14:05 PM IST (3-second delay from the first hop). The email was delivered to our mail server 14 seconds after it was created.
However, according to the Haystack logs, the ticket creation occurred at 8:48 PM IST on 11th October, indicating a delay of approximately 34 minutes on our end. In such cases, we can raise an L2 ticket to address the issue.
During that time, there was an issue that caused the delay in ticket creation.
Reference ticket: [Ticket Link]
If the email was received by the Freshdesk SMTP server, and the time the ticket creation occured in Freshdesk are the SAME, or CLOSE ENOUGH, then this indicates that the Delay is not at our end. You can analyze all the Received: lines (hops) in the headers to identify which hop caused the delay or use the Google Admin Toolbox to analyze them. In this way, you can inform the customer that the delay did not occur on our end.