Take a look at the Internet headers within the message. Depending how you access your email, you may need to "show original" or "show all headers."
Within the Internet headers, there should be two or more "Received:" headers that show the steps the email took, from when it left your granddaughter's computer until it arrived in your Sonic mailbox.
Here's an example of those headers, taken from a Sonic MOTD that was sent approximately 1:55 am this morning:
Code: Select all
Received: from c.mx.sonic.net (a.spam-proxy.sonic.net [157.131.224.145])
by a.local-delivery (8.14.7/8.14.7) with ESMTP id 28E8tt7T030345
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
for <deleted@lds.sonic.net>; Wed, 14 Sep 2022 01:55:55 -0700
Received: from listman.sonic.net (listman.sonic.net [64.142.105.165])
by c.mx.sonic.net (8.14.7/8.14.7) with ESMTP id 28E8ttvR065737
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
for <deleted@sonic.net>; Wed, 14 Sep 2022 01:55:55 -0700
Received: from listman.sonic.net (localhost [127.0.0.1])
by listman.sonic.net (8.15.2/8.16.1) with ESMTP id 28E8toTS3514023
for <deleted@sonic.net>; Wed, 14 Sep 2022 01:55:55 -0700
Received: from a.mx.sonic.net (a.mx.sonic.net [157.131.224.68])
by listman.sonic.net (8.15.2/8.16.1) with ESMTP id 28E8tn423514016
for <motd@listman.sonic.net>; Wed, 14 Sep 2022 01:55:50 -0700
Received: from sonicstatus.com (sonicstatus.com [147.75.192.220])
by a.mx.sonic.net (8.14.7/8.14.7) with ESMTP id 28E8tmxg223805
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
for <motd@lists.sonic.net>; Wed, 14 Sep 2022 01:55:49 -0700
Received: from sonicstatus.com (localhost [127.0.0.1])
by sonicstatus.com (8.14.7/8.14.7) with ESMTP id 28E8tlYp030735
for <motd@lists.sonic.net>; Wed, 14 Sep 2022 01:55:47 -0700
Received: (from apache@localhost)
by sonicstatus.com (8.14.7/8.14.7/Submit) id 28E8tlk8030734;
Wed, 14 Sep 2022 01:55:47 -0700
These headers are in reverse order (the newest is at the top). This particular series shows the message was generated at 1:55:47 am this morning. The newest header shows it landed in my mailbox at 1:55:55 am (about eight seconds later). Each "Received:" header shows the which particular server touched it each time.
Here's another set, for an email sent from an external source on Monday:
Code: Select all
Received: from b.mx.sonic.net (a.spam-proxy.sonic.net [157.131.224.145])
by a.local-delivery (8.14.7/8.14.7) with ESMTP id 28CJCmbm024853
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT);
Mon, 12 Sep 2022 12:12:48 -0700
Received: from a.mail-forward.sonic.net (a.mail-forward.sonic.net [184.23.169.21])
by b.mx.sonic.net (8.14.7/8.14.7) with ESMTP id 28CJCkgk000627
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT);
Mon, 12 Sep 2022 12:12:47 -0700
Received: from a.local-delivery (a.spam-proxy.sonic.net [157.131.224.145])
by a.mail-forward.sonic.net (8.15.2/8.15.2) with ESMTP id 28CJCkoK4150978;
Mon, 12 Sep 2022 12:12:46 -0700
Received: from f.mx.sonic.net (a.spam-proxy.sonic.net [157.131.224.145])
by a.local-delivery (8.14.7/8.14.7) with ESMTP id 28CJCk4T024575
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
for <ae5fe2e6700623a10a6874ae5816abcc@lds.sonic.net>; Mon, 12 Sep 2022 12:12:46 -0700
Received: from outbound-relay5.guardedhost.com (outbound-relay5.guardedhost.com [216.239.133.205])
by f.mx.sonic.net (8.14.7/8.14.7) with ESMTP id 28CJCiKT042524
(version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT)
for <deleted@deleted>; Mon, 12 Sep 2022 12:12:45 -0700
Received: from mail.guardedhost.com (tev-mail-relay2.omnis.com [IPv6:2607:fe90:1:1::139])
by outbound-relay5.guardedhost.com (Postfix) with ESMTP id 4MRGSr0wYvzkGt
for <deleted@deleted>; Mon, 12 Sep 2022 19:12:43 +0000 (GMT)
Received: from staff (107-131-120-52.lightspeed.sntcca.sbcglobal.net [107.131.120.52])
(Authenticated sender: sender@example.com)
by mail.guardedhost.com (Postfix) with ESMTPA id 4MRGSp4DDszyQy
for <deleted@deleted>; Mon, 12 Sep 2022 19:12:42 +0000 (GMT)
This one shows the sender initiated the email at 12:12:42 pm (PDT) on Monday, and it landed in my mailbox at 12:12:48 pm.
If you look at the "Received:" headers for your granddaughter's email, you should be able to see which server held onto it. Perhaps that server was processing a bunch of email and got bogged down.