DLF Schema for Email service The email DLF schema represents delivery done by an mail transfer agent between one one recipient. Each DLF record contains the information related to the process of delivering between one sender and one recipient. Each exchange between one sender and one recipient will results in one and only one DLF record. If one sender is sending to multiple recipients, the DLF file should contains one record for each recipient. This DLF schema is different from the other ones because it contains pre-analysed data. It is currently in redesign and will become something that will more closely resemble what you can usually find in an email log file. Different information for each phase of the mail delivery process. That schema will probably become a derived schema from the new base schema. The time of the first event regarding that delivery. That should be the time the email enter the delivery process. The hostname on which the MTA is running. That original intent of that field was to analyse email servers' farm which used syslog to centralize their logs. This method of analysis for multiple servers was never actually used and is considerd obsolete. The queue identifier. This should be the identifier that can be used to reconstitute the delivery process from the native log file regarding the delivery that this DLF record represents. The content of the Message-ID header of the delivered message. The local part of the sender's email address. The hostname of the sender's email address. The hostname from which the email was received. For email submitted via the sendmail interface or other similar mechanism, this should be localhost. The ip address from which the email was received. For email submitted via the sendmail interface or other similar mechanism, this should be 127.0.0.1. The size of the message. The time that it took to deliver the message. This should be equivalent to the time of the delivery event minus the value of the time field. This field was never actually used and is obsolete. The local part of the recipient's email address. The hostname of the recipient's email address. The hostname to which the email was delivered. If the recipient is a local user and this was the "final" delivery, this should be localhost. The ip address to which the email was delivered. If the recipient is a local user and this was the "final" delivery, this should be 127.0.0.1. The status code of the delivery. Only standardized code are sent which is used when the delivery succeeded without error and deferred for when the email still wasn't delivered at the end of the log file. Other values are specific to each service. The complete native status message related to the email's delivery.