Application trigger
Record the expected action and time, with the timezone. Did the application create a send request? A confirmation screen may only prove that an earlier form or database step succeeded.
Resources / Message timeline
What does each email record prove?
Build a timeline for one message. Keep private evidence in an agreed controlled location.
Queue and provider response
Identify whether the request entered a queue and reached the sending provider. Retain a safe reference connecting those steps. Provider acceptance is not the same as a recipient reading the message.
Later events
Review available delivery, delay, rejection and suppression events. Note what the provider's event means and whether the application handled it.
Recipient confirmation
For an authorized test, record whether the intended recipient actually received it and where it appeared. A missing confirmation leaves that part unproven.
Recovery and replay
In a fictional receipt incident, repairing authentication may allow future sends while an earlier failed receipt remains unsent. Review replay separately and avoid duplicate messages. A recovered monitor does not establish that replay occurred.
Discuss an email investigation or prepare the sender inventory.