Skip to content

Quarantined Messages

The Quarantined Messages page lists the email messages that have been quarantined for all your protected mailboxes.

This option is only available if your license includes Sophos Email Security.

If you aren't using M365 Security, you only see one list, with quarantined emails from all your email domains.

If you're using M365 Security and have turned on Auto search and destroy, you see two tabs. Click Post delivery quarantine to see emails quarantined by M365 Security. Your other quarantined emails are listed under Email security quarantine.

If you have domains connected with Sophos Gateway and Sophos Mailflow, click Type to select which one to view.

Quarantined message list

This section applies to all types of quarantined emails.

By default the report displays the emails that have been processed during the current day.

Search: You can search emails by Subject, Sender, or Recipient.

You can order messages by Date, Sender, Recipient, and Reason. You can also view the message Subject.

There's no indication of email direction in the Post delivery quarantine list because all the emails are inbound.

To view message details, click the Subject.

Email gateway message details

If you don't have M365 Security, this section applies to all your mails. However, if M365 Security is turned on, this section applies to your non-M365 gateway messages only.

In Message Details you can click the following for more information about the message:

  • Details: shows general information about the message.

    Click Add to blocklist if you want to add the IP to the Inbound Allow/Block list, then click Ok to confirm your choice. Any sender using this IP address is blocked. Click Cancel to cancel the action.

  • Raw Header: shows the email header details.

  • Message: shows the body of the email.
  • Attachments: shows the name and size of attachments.

You can delete or release emails from the message list, or from Message Details. Do as follows:

  • Click Release to release messages from quarantine and send them to users.
  • Click Release and Allow to release messages and add the IP to the Inbound Allow/Block list.
  • Click Delete to delete quarantined messages.
  • Click Delete and Block to delete messages and add the IP to the Inbound Allow/Block list.

Post delivery quarantine message details

This section only applies to messages in the Post delivery quarantine list. If you don't have M365 Security turned on, this list doesn't appear.

In Message Details you can click the following for more information about the message:

  • Details: shows general information about the message.

    Click Add to blocklist if you want to add the IP to the Inbound Allow/Block list, then click Ok to confirm your choice. Any sender using this IP address is blocked. Click Cancel to cancel the action.

  • Raw Header: shows the email header details.

  • Message: shows the body of the email.
  • Attachments: shows the name and size of attachments.

You can delete or release emails from the message list, or from Message Details. Do as follows:

  • Click Release to release messages from quarantine and send them to users.
  • Click Delete to delete quarantined messages.

Emails in Post delivery quarantine that aren't released or deleted within 30 days are deleted.

Back to top