Quarantined Messages

The Quarantined Messages page lists the email messages that have been quarantined for all your protected mailboxes.

Restriction This option is only available if your license includes Sophos Email.

If you aren't using O365 Security, you only see one list, with quarantined emails from all your email domains.

If you're using O365 Security and have turned on Auto search and destroy, you see two tabs. Click Post delivery quarantine to see emails quarantined by O365 Security. Your other quarantined emails are listed under Email gateway quarantine.

Quarantined message list

This section applies to all types of quarantined emails.

By default the report displays the emails that have been processed during the current day.

Search: You can search emails by Subject, Sender, or Recipient.

You can order messages by Date, Sender, Recipient, and Reason. You can also view the message Subject.

There's no indication of email direction in the Post delivery quarantine list because all the emails are inbound.

To view message details, click the Subject.

Email gateway message details

If you don't have O365 Security, this section applies to all your mails. However, if O365 Security is turned on, this section applies to your non-O365 gateway messages only.

In Message Details you can click the following for more information about the message:

  • Details: shows general information about the message.

    Click Add to blocklist if you want to add the IP to the Inbound Allow/Block list, then click Ok to confirm your choice. Any sender using this IP address is blocked. Click Cancel to cancel the action.

  • Raw Header: shows the email header details.
  • Message: shows the body of the email.
  • Attachments: shows the name and size of attachments.

You can delete or release emails from the message list, or from Message Details. Do as follows:

  • Click Release to release messages from quarantine and send them to users.
  • Click Release and Allow to release messages and add the IP to the Inbound Allow/Block list.
  • Click Delete to delete quarantined messages.
  • Click Delete and Block to delete messages and add the IP to the Inbound Allow/Block list.

Post delivery quarantine message details

This section only applies to messages in the Post delivery quarantine list. If you don't have O365 Security turned on, this list doesn't appear.

In Message Details you can click the following for more information about the message:

  • Details: shows general information about the message.

    Click Add to blocklist if you want to add the IP to the Inbound Allow/Block list, then click Ok to confirm your choice. Any sender using this IP address is blocked. Click Cancel to cancel the action.

  • Raw Header: shows the email header details.
  • Message: shows the body of the email.
  • Attachments: shows the name and size of attachments.

You can delete or release emails from the message list, or from Message Details. Do as follows:

  • Click Release to release messages from quarantine and send them to users.
  • Click Delete to delete quarantined messages.

Emails in the Post delivery quarantine that aren't released or deleted within 30 days are deleted.