Quarantine

The Quarantine page holds messages that SmarterMail stopped from being delivered because they were flagged as spam, caught by Protected Identity settings, or found to contain a virus. Rather than deleting these messages outright, SmarterMail sets them aside so you can review them, confirm the detection and decide what happens next: resend a message that was flagged by mistake, move or download it for further investigation, or delete it.

Quarantined messages used to be listed as tabs on the Spool page, mixed in with messages waiting to be delivered. They now have their own page under Manage, and the navigation sidebar shows how many messages are in quarantine, so you can tell at a glance whether anything needs your attention.

The page is split into two tabs:

Spam Quarantine - Messages that SmarterMail identified as spam or abuse before they reached their recipients. Most are messages sent by your own users that exceeded the outbound spam weight threshold, or whose sender tripped an Intrusion Detection rule. A sudden increase here is often the first sign that an account has been compromised and is being used to send spam. This tab also holds inbound messages that Protected Identities flagged as spoofing one of your users.
Virus Quarantine - Inbound and outbound messages that one of SmarterMail's antivirus engines flagged as infected, when that engine is set to quarantine infected messages rather than delete them.

Both tabs work the same way. For details on searching, viewing and acting on messages, see Reviewing Quarantined Messages. For how long messages are kept and how many can be listed, see Retention and Display Limits.

Spam Quarantine

The Spam Quarantine tab holds messages that SmarterMail's antispam and abuse detection determined were spam before they were delivered. It exists so that a compromised mailbox, a misconfigured application or an account sending spam through your server can't send that spam out to the Internet unchecked. The message is intercepted and held instead of being delivered.

This is separate from inbound spam filtering. Spam arriving from outside senders is handled by the inbound spam checks and, depending on its weight, is delivered to the recipient's Junk E-mail folder, tagged or rejected. It only lands in Spam Quarantine if a routing rule sends it there, or if Protected Identities flags it as spoofing one of your users and the domain is set to quarantine those messages.

Use this tab to find out why a message was flagged (for example, to confirm whether a user's account was compromised and is relaying spam), adjust your antispam settings, and resend any message that was quarantined by mistake.

How a Message Ends Up in Spam Quarantine

Quarantining is a specific, configurable outcome. A message that picks up some spam weight isn't quarantined automatically. A message is held here when any of the following occurs:

Outbound spam weight exceeds the configured threshold. When Outbound Weight Threshold is enabled on the SMTP Blocking card of the Antispam > Options page, outgoing messages are scored using the same spam checks used for inbound mail (including Message Sniffer and Cyren Premium Antispam, if licensed and enabled). If a message's weight meets or exceeds the threshold, SmarterMail applies the Outbound Block Action: Block Message rejects the message outright, and Quarantine Message holds it here. Spam Quarantine is only used when the action is set to Quarantine Message.
An Intrusion Detection rule with a Quarantine action fires. If a sending account trips an Intrusion Detection rule whose action is set to Quarantine rather than Block, the account's outgoing messages are held here for the rule's block period.
A routing rule with a Quarantine Message action matches the message. Routing rules can quarantine incoming or outgoing messages that match conditions you define (sender, recipient, subject and so on), regardless of spam weight.
Protected Identities flags the message as spoofing one of your users. When a domain's Action on Suspected Spoofing setting is Move to quarantine, inbound messages that SpamFoo flags as impersonating one of the domain's users are held here instead of being delivered. This setting is configured per domain in the domain's settings, and its default for new domains is set on the Domain Defaults page.

The outbound weight threshold and Intrusion Detection quarantine don't only apply to mail leaving the server. Messages sent from one local user to another are also checked, depending on the Internal Spam Check Behavior setting on the Antispam > Options page. Check All Messages checks every local recipient, Check Other Domains checks only local recipients on a different domain than the sender, and Bypass Spam Checks skips local recipients entirely. An Intrusion Detection quarantine applies to local recipients even when Outbound Weight Threshold is disabled. A message a user sends to their own mailbox, system-generated messages, and messages that were already released from quarantine are never held.

Note: The Outbound Weight Threshold, Outbound Block Action and Internal Spam Check Behavior settings are on the Options tab of the Antispam page.

Virus Quarantine

When one of SmarterMail's antivirus engines (ClamAV, Microsoft Defender, Cyren Zero-Hour Antivirus or a custom command-line antivirus integration) identifies a message as infected and its action is set to Quarantine Message, the message is pulled out of normal delivery and placed in Virus Quarantine. Deleting the message could lose a false positive, and delivering it could infect a mailbox, so SmarterMail sets it aside for an administrator to inspect, confirm the detection and decide what to do next.

Inbound and Outbound Messages

Virus Quarantine isn't limited to one direction. Both inbound messages (arriving from the Internet for a local mailbox) and outbound messages (sent by a local user to an outside recipient) are quarantined here if they're flagged as infected. For example, if an outside sender emails one of your users a Word document containing a macro virus, ClamAV can catch and quarantine it before it reaches the mailbox. And if a local account is compromised and starts sending infected attachments, that outbound mail is caught too, which protects your server's sending reputation as well as the recipients.

Note: Which messages are scanned depends on the configuration of each antivirus engine on the Antivirus page. Each engine can be enabled or disabled independently for messages with and without attachments. If an engine's action is set to Delete Message or No Action instead of Quarantine Message, infected messages caught by that engine never appear here. They're deleted outright or delivered, respectively.

Reviewing Quarantined Messages

The Spam Quarantine and Virus Quarantine tabs share the same layout and actions. Click Refresh to reload the list, and use the search box to find messages by sender address or file name. The page remembers the last tab you viewed.

Grid Columns

File Name - The unique name of the message's .eml file on the server.
Date - The date and time the message was created.
Sender - The email address that sent the message (the envelope sender, or return path).
Recipients - The number of recipients the message was delivered to, out of the total number of recipients. For example, 0/3 means none of the three intended recipients have received the message because it's being held.
Size - The size of the message on disk.
Attempts - The number of delivery attempts made before the message was quarantined.
Time in Spool - How long the message has been in quarantine.
Time of Removal - The date and time the message reaches the 30-day limit and is permanently deleted.

Viewing a Message

Click a message to open it in a popup window. The message opens in text view, with formatting removed, so nothing in the message runs when you open it. From the popup you can:

View Recipients - See the full list of intended recipients.
Download EML - Download the raw .eml file.
Delete - Permanently delete the message.
Actions (⋮) - Switch between View HTML, View Text, View Header (the message's email headers) and View HDR (SmarterMail's delivery file for the message, which holds the envelope sender, recipients and delivery details).

Note: Stay in text view when reviewing messages in Virus Quarantine. The message may contain an active exploit or malicious script, and text view keeps the preview itself from becoming a way to infect the computer you're using.

Actions

Select one or more messages, then choose an action from the Actions (⋮) menu, or right-click a message:

Resend - Releases the selected messages from quarantine and places them back in the spool for delivery to their intended recipients. Resend forces delivery: the message is released with a bypass flag, so it isn't checked again by the spam checks, including the outbound spam weight threshold and Protected Identities spoofing detection (for Spam Quarantine), or rescanned by the antivirus engines (for Virus Quarantine), and it won't be quarantined again. Only resend a message after you've confirmed it's a false positive. Resending a message that really is spam or spoofed delivers it to the recipients, and resending an infected message delivers the virus. If you're unsure about an infected message, download it or move it and check it with a dedicated antivirus tool first.
Move Messages - Moves the selected messages out of quarantine to a folder on the server. The default is a MovedSpoolItems folder inside your spool folder (for example, C:\SmarterMail\Spool\MovedSpoolItems\), but you can enter any folder path. Messages moved out of quarantine are no longer deleted after 30 days, so this is how you keep messages longer, for example for a compliance investigation. Don't move infected messages into a user's mail folder, where they could be opened by the user.
Download EML - Downloads the raw .eml file so it can be opened in a mail client or text editor for closer inspection, such as reviewing the full header trail.
Delete - Permanently deletes the selected messages. This can't be undone.
Delete All - Permanently deletes every message in the current tab. Delete All in Spam Quarantine doesn't affect Virus Quarantine, and vice versa. This can't be undone.

Retention and Display Limits

Messages are kept in quarantine for 30 days and are then automatically and permanently deleted. The 30-day period is built into SmarterMail and can't be changed from the interface or the API. If a message needs to be reviewed, resent or kept as evidence, handle it before its Time of Removal, or use Move Messages to keep it longer.

To keep the page fast, the Spam Quarantine and Virus Quarantine tabs together list no more than 5,000 messages. For example, if 2,000 messages are listed under Spam Quarantine and 3,000 under Virus Quarantine, the limit has been reached. The count on each tab still reflects every message in that quarantine, so when the limit is reached, a notice appears at the top of the page and the tab counts may be higher than the number of messages listed. Any messages beyond the limit can be reviewed and handled in the quarantine folders on the server.