In principle, we do not store any messages unless archiving is active. Only blocked messages are available in quarantine for 14 days and can be viewed or downloaded in full.
If archiving is active, then you as an admin can also view all messages of the domain via the web interface in the protocol search and access its headers.
This is not possible without activated archiving. Without archiving activated you can only access the information in the log search (date, sender, recipient, subject, etc.).