sys_email Table — ServiceNow Reference

Table Reference/sys_email

The sys_email table stores all emails sent and received by the ServiceNow instance. Part of the Platform module, this table grows extremely large in production environments — always filter by type (inbound/outbound) and date ranges to avoid performance issues.

What This Table Is

The sys_email table is the complete log of all email communication flowing through your ServiceNow instance. Every inbound email (from users creating incidents, replies to notifications) and outbound email (notifications, alerts, manual sends) creates a record here. This is the central audit trail for all email activity, storing the full message content, headers, attachments, and processing status.

Owned by the Platform module, this table supports the entire email processing pipeline. Inbound emails flow through the email processing engine that creates or updates records based on email content. Outbound emails generate from notification engines, scheduled jobs, and direct user actions. The table integrates tightly with the notification system (sysevent_email_action) and email accounts configuration (sys_email_account).

This table does not extend any parent table — it's a standalone platform table. No tables extend sys_email either. However, it connects to virtually every other table through the target_table and target fields when emails relate to specific records.

In large enterprise environments, this table commonly contains millions of records. A typical production instance with 50,000 users might accumulate 100,000+ email records monthly. The table includes both successful deliveries and failures, making it enormous over time. Most queries should include date ranges and direction filters to maintain performance. Email content and attachments contribute significantly to database size.

When You'll Script Against This Table

Developers typically query sys_email in Business Rules (especially on task tables to check for recent email activity), scheduled jobs that clean up old emails, and Script Includes that build email audit reports. Integration scripts often query this table to verify email delivery status or extract email content for external systems. Background scripts frequently target this table for data cleanup and archival processes.

Most users can read their own email records, but the admin role is typically required for broad access. The email_admin role provides specific email management capabilities. Scripts running in global scope can access all records, while scoped applications may have limited visibility based on ACL configurations.

Common scripting patterns:

Check if specific notifications were sent to prevent duplicate emails
Extract failed email deliveries for retry processing or user notification
Build email audit reports showing communication history for specific records
Archive or delete old email records to manage database size
Parse inbound email content to extract data for custom processing workflows
Monitor email volume and delivery success rates for system health dashboards
Track email response times and user engagement patterns for process optimization

Table Gotchas

⚠️

Never query sys_email without date range and type filters. The table is massive and unfiltered queries will timeout or severely impact performance.

The target field stores the sys_id but behaves like a string, not a true reference field — you can't dot-walk through it
Email content in body_text is limited to 8000 characters — longer content gets truncated without warning

⚠️

The state field uses different values than typical ServiceNow states: 'sent', 'ready', 'failed', 'ignored' — not numbers.

Attachments are stored in separate sys_attachment records — the email record won't show attachment content directly
Inbound emails may create multiple records if they're processed by multiple email accounts or forwarding rules

⚠️

The type field ('send' vs 'receive') is not indexed by default — add an index if you frequently filter by direction on large datasets.

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

The sysevent_email_action table connects directly to sys_email through the email processing pipeline — each notification event that triggers an email creates records in both tables. The sys_email_account table defines the SMTP and IMAP configurations used for sending and receiving emails logged in sys_email.

The sys_user table links through both sender and recipient email addresses for user identification. When emails relate to specific records, the target_table field commonly points to incident, sc_request, or other task-based tables. The sys_attachment table stores file attachments sent with emails, referenced by the email's sys_id.

Developers frequently join sys_email with sys_journal_field to build complete communication histories showing both system updates and email exchanges. The notification table provides the templates and rules that generate outbound emails, making it essential for troubleshooting email delivery issues.

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Key Fields

Column	Type	Label	Notes
type	choice	Type	Direction of email: 'send' for outbound, 'receive' for inbound. Not indexed by default — add index if filtering frequently on large datasets.
state	choice	State	Processing status using text values: 'sent', 'ready', 'failed', 'ignored', 'draft'. Unlike most ServiceNow states, these are strings not integers.
recipients	string	Recipients	Comma-separated email addresses for outbound emails. For inbound emails, contains the original To: header which may include multiple addresses.
sender	string	Sender	Email address of sender. For outbound emails, typically the configured system sender. For inbound emails, the user's actual email address.
subject	string	Subject	Email subject line, often containing record numbers or reference identifiers for tracking. Limited to 255 characters.
body_text	string	Body	Plain text email content, limited to 8000 characters. Longer content gets silently truncated — use attachments for large content.
body	string	Body HTML	HTML version of email content when available. Also limited to 8000 characters, truncated without warning if exceeded.
target_table	string	Target Table	Table name (like 'incident', 'sc_request') that this email relates to. Used with target field to link emails to specific records.
target	string	Target	Sys_id of the related record in target_table. Stores as string, not reference — cannot dot-walk, must use getValue() for comparisons.
message_id	string	Message ID	SMTP Message-ID header for tracking and preventing duplicates. Critical for email threading and reply matching.
in_reply_to	string	In Reply To	Message-ID of email this is replying to. Used for threading emails and associating responses with original notifications.
cc_list	string	CC	Comma-separated CC recipients. May be empty even if original email had CC addresses due to privacy or processing rules.
bcc_list	string	BCC	Comma-separated BCC recipients, typically populated only for outbound emails since inbound BCC headers are usually stripped.
user_id	reference	User	Reference to sys_user record. For outbound emails, the user who triggered the notification. For inbound, the identified sender or empty if not recognized.
mailbox	string	Mailbox	Email account or mailbox used for processing. References configuration in sys_email_account for SMTP/IMAP settings.
size	integer	Size	Email size in bytes including headers and body. Does not include attachments, which are stored separately in sys_attachment.
error_string	string	Error String	Error message for failed emails. Contains SMTP errors, authentication failures, or processing exceptions. Only populated when state is 'failed'.
notification	reference	Notification	Reference to sys_email_notification record that generated this outbound email. Empty for inbound emails or manually sent messages.
priority	choice	Priority	Email priority level: 1 (high), 3 (normal), 5 (low). Affects processing order in email queue but not guaranteed delivery priority.
watermark	string	Watermark	Unique identifier added to outbound emails for reply tracking. ServiceNow uses this to match inbound replies to original records.

Common Queries

Get recent outbound emails for monitoring delivery

var gr = new GlideRecord('sys_email');
gr.addQuery('type', 'send');
gr.addQuery('sys_created_on', '>=', gs.daysAgoEnd(1));
gr.orderByDesc('sys_created_on');
gr.setLimit(100);
gr.query();
while (gr.next()) {
    gs.log('Email: ' + gr.subject + ' - State: ' + gr.state);
}

Find failed emails for specific user to investigate delivery issues

var gr = new GlideRecord('sys_email');
gr.addQuery('state', 'failed');
gr.addQuery('user_id', user_sys_id); // Replace with actual user sys_id
gr.addQuery('sys_created_on', '>=', gs.daysAgoEnd(7));
gr.orderByDesc('sys_created_on');
gr.query();
while (gr.next()) {
    gs.log('Failed email: ' + gr.subject + ' - Error: ' + gr.error_string);
}

Get all emails related to specific incident for communication audit

var gr = new GlideRecord('sys_email');
gr.addQuery('target_table', 'incident');
gr.addQuery('target', incident_sys_id); // Replace with actual incident sys_id
gr.orderBy('sys_created_on');
gr.query();
while (gr.next()) {
    var direction = gr.type == 'send' ? 'Outbound' : 'Inbound';
    gs.log(direction + ': ' + gr.sender + ' -> ' + gr.recipients + ' | ' + gr.subject);
}

Count emails by state in last 24 hours for system health monitoring

var ga = new GlideAggregate('sys_email');
ga.addQuery('sys_created_on', '>=', gs.daysAgoEnd(1));
ga.addAggregate('COUNT');
ga.groupBy('state');
ga.query();
while (ga.next()) {
    var state = ga.state;
    var count = ga.getAggregate('COUNT');
    gs.log('Emails in ' + state + ' state: ' + count);
}

Wrong way vs right way to query for recent email activity

// WRONG - will timeout on large instances
// var gr = new GlideRecord('sys_email');
// gr.addQuery('subject', 'CONTAINS', 'INC');
// gr.query();

// RIGHT - always include date range and specific filters
var gr = new GlideRecord('sys_email');
gr.addQuery('type', 'send');
gr.addQuery('sys_created_on', '>=', gs.daysAgoEnd(1)); // Critical for performance
gr.addQuery('subject', 'CONTAINS', 'INC0123456');
gr.query();

Related Tables

sys_user sys_attachment incident

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue