Spam Quarantine

The Spam Quarantine grid holds outgoing messages — that is, messages sent by a local user or domain, destined for a remote recipient — that SmarterMail's antispam engine determined were spam before they ever left the server. This is distinct from inbound spam filtering: messages coming into the server from the outside world are handled by the inbound spam checks and move (or don't move) into a recipient's Junk E-mail folder. Spam Quarantine exists so that a compromised mailbox, a misconfigured application, or an infected user account sending spam through your server does not get to blast that spam out to the Internet unchecked — the message is intercepted and held instead of being delivered.

Quarantined messages are held for a maximum of 30 days, after which they are automatically and permanently deleted from the server. This 30-day window is a fixed, built-in limit and is not a value administrators can change from the interface — if a message needs to be reviewed, resent, or extracted for evidence, it must be handled before the 30-day mark. Administrators can use this grid to investigate why a particular message was flagged (for example, to confirm whether a user's account was compromised and is being used to relay spam), adjust antispam settings accordingly, and resend any messages that were quarantined by mistake (a false positive).

How a Message Ends Up in Spam Quarantine

Not every outbound message that scores some spam weight lands in this grid — quarantining is a specific, configurable outcome of the outbound spam-check pipeline, not something that happens automatically whenever a message picks up spam points. A message is diverted here when any of the following occurs:

• Outbound spam weight exceeds the configured threshold. When Outbound Weight Threshold is enabled on the SMTP Blocking card of the Antispam > Options page, every outgoing message is scored using the same spam checks used for inbound mail (including Message Sniffer and/or Cyren Premium Antispam, if licensed and enabled). If a message's cumulative weight meets or exceeds that threshold, SmarterMail applies whichever Outbound Block Action is configured — either Block Message (the message is rejected outright and never spooled for delivery) or Quarantine Message (the message is diverted here instead of being delivered). Spam Quarantine is only populated when the action is set to Quarantine Message.
• An Intrusion Detection (abuse detection) rule with a Quarantine action fires. If a sending account trips an IDS/abuse-detection rule that has its action set to Quarantine rather than Block, every subsequent outgoing message from that sender is routed to Spam Quarantine until the condition clears.
• A Routing Rule with a Quarantine action matches the message. System administrators can build custom routing rules that explicitly quarantine outbound mail matching certain conditions (sender, recipient, subject, etc.), independent of the spam weight threshold.

In every case, the underlying trigger is still SmarterMail's antispam/abuse-detection logic — Spam Quarantine is not a general holding area for all outbound mail, only for outbound mail that has been positively identified as spam or otherwise abusive.

Grid Columns

The following details are shown for each quarantined message:

• File Name - The unique name of the .eml file as stored on the SmarterMail server's disk.
• Date - The date and time the message was originally created and flagged for quarantine.
• Sender - The email address that originally sent the message (the envelope sender/return path).
• Recipients - The number of delivered recipients out of the total intended recipients (for example, 0/3 means none of the three intended recipients have received the message because it is being held).
• Size - The total size of the message on disk, in kilobytes.
• Attempts - The number of delivery attempts made before the message was quarantined.
• Time in Spool - How long the message has been sitting in quarantine so far.
• Time of Removal - The date and time the message will hit the 30-day limit and be automatically and permanently deleted from the server.

To view the contents of a message or see its intended recipients, click on the entry's row. The email will load in a popup window, where the recipient list, headers, and body can be reviewed to help determine why the message was flagged.

The following actions can be taken on selected entries using the Actions (⋮) button:

• Resend - Releases the selected message(s) from quarantine and places them directly back into the delivery spool for their originally intended recipients. This is important to understand: a resent message is marked with a special bypass flag so that it is not re-evaluated against the outbound spam weight threshold or re-quarantined, even if it would otherwise score as spam again. In other words, Resend forces delivery. Only use it after confirming the message is a genuine false positive (for example, a legitimate marketing message from a trusted sender that happened to trip the weight threshold) — resending a message that is actually spam will deliver that spam to its recipients with no further filtering.
• Move Messages - Moves the location of the selected message(s) from the quarantine directory to a new path on the server. Use the default path provided or enter any folder path on the server. Moving the .eml files to their own folder is useful when an administrator wants to preserve or review messages (for example, for a compliance investigation) outside of the normal 30-day quarantine lifecycle, since files moved out of the quarantine folder are no longer subject to automatic deletion.
• Download EML - Downloads the raw .eml file for the message so it can be opened in a mail client or text editor for closer inspection (for example, to examine the full header trail and confirm which spam check contributed the most weight).
• Delete / Delete All - Permanently removes the selected message(s), or every message currently in the grid, from quarantine. Deletion is immediate and cannot be undone.