User Portal: Mail Quarantine

On this tab, end users can view and release messages held in quarantine.

Note – The Mail Quarantine tab is available if either POP3 or SMTP has been activated in WebAdmin and the users have been configured to use these services. If users should receive emails both via SMTP and POP3, the emails will be organized into two tabs POP3 Quarantine and SMTP Quarantine, both providing a similar functionality.

The Mail Quarantine tab shows an overview of all emails addressed to the users but blocked and quarantined by Sophos UTM. For POP3 quarantine emails to be listed, users have to enter their POP3 credentials on the POP3 Accounts tab.

Sort and Filter Quarantined Emails

By default, all emails are shown. If the list contains more than twenty emails, it is split into several chunks which can be browsed with Next (>) and Previous (<) buttons.

Users can influence which items are displayed:

Sort by: By default, the list is sorted by time of arrival. Messages can be sorted by date, subject line, sender address, and message size.

and show: The checkbox allows to display 20, 50, 100, 250, 500, 1000, or all messages per page. Note that showing all messages may take a lot of time.

Several elements on the page let users filter their emails:

• # messages quarantined: On top of the page, several checkboxes allow to show or hide emails by the reason why they were quarantined (malware, spam, expression match, file extension, MIME type, unscannable, others).
• Addresses or Accounts: Allows to filter the messages according to the recipient address (SMTP) or account (POP3).
• Sender/Rcpt/Subject substring: Here users can enter a sender, recipient (only with POP3), or subject to search for in the quarantined messages.
• Received date: To only show messages processed during a certain time frame, users can enter a date or select a date from the Calendar icon.

Manage Quarantined Emails

Users can apply actions on a message using the drop-down list in front of the message. An action can also be applied to several selected messages. Use the checkbox in front of each message or click a message to select it. Then select one of the actions available in the drop-down list below the table. The following actions are available:

• View (only available for an individual message): Opens a window with the contents of the email.
• Download: Selected messages will be downloaded in EML format.
• Delete: Selected messages will be deleted irrevocably.
• Whitelist Sender (only available for an individual message): Moves the email to your inbox and adds the sender to your whitelist (Sender Whitelist tab). Successive emails of this sender will not be quarantined. Note, that mails containing malicious content will always be quarantined, even if the sender is on the whitelist.
• Release: Selected messages will be released from quarantine.
• Release and report as false positive: Selected messages will be released from quarantine and reported as false positive to the spam scan engine.

Note – The allowed actions depend on the reason why the email was quarantined, and on the WebAdmin settings. Users can only release messages they are explicitly allowed to. Only an administrator can release all messages held in quarantine.

Select global cleanup action: Here you find several deletion options that will be applied on messages globally, that is, regardless whether they are selected and/or displayed or not.