Select your language

Hosted Exchange Quarantine

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find more information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

 

What Is Hosted Exchange Quarantine?

Quarantine is part of the server-side spam and threat protection provided by Hosted Exchange. Messages classified as suspicious may be held in quarantine instead of being delivered directly to the mailbox.

Quarantine is managed in the Email Threat Protection section.

 

Difference Between Quarantine and the Spam Folder

Quarantine is not the same as the Junk or Spam folder in the mailbox.

  • Quarantine: The message was held by the server-side spam or threat protection and has not yet been delivered to the mailbox.
  • Junk or Spam folder: The message has already been delivered to the mailbox but was classified as spam or moved to the corresponding folder.

 

Requirements

To fully manage quarantine and the organisation-wide allowlist and blocklist, you need a user with administrator permissions.

Access via a link in a SpamLab or quarantine report may provide limited permissions and does not automatically provide all administrator functions.

Note: If you do not have administrator permissions, contact the administrator of your Hosted Exchange organisation.

 

View Quarantine and Release Emails

  1. Sign in with a user account that has administrator permissions.
  2. Open the Email Threat Protection section.
  3. Open Quarantine.
  4. Search for the relevant message.
  5. Check the sender, subject and other available details.
  6. Select the required message.
  7. Click Release if you consider the message trustworthy.

After release, the message is delivered to the mailbox.

Depending on the available function, you may be able to permanently allow the sender at the same time. This can prevent future messages from the same sender from being quarantined again because of the same spam filter check.

More information about releasing individual emails:

https://www.green.ch/en/hosted-exchange-release-email-in-edgepilot

 

Permanently Allow or Block Senders

If messages from a particular sender are regularly held by mistake, administrators can permanently allow the sender using the allowlist.

Unwanted senders or sources can be blocked using the blocklist.

The allowlist and blocklist can contain the following entry types:

  • Email addresses
  • Domains
  • IP addresses

Entries in the allowlist or blocklist apply to the entire Hosted Exchange organisation and may therefore affect all mailboxes in the organisation.

An allowlist affects spam filtering for a listed sender. However, it does not provide a general delivery guarantee. Other security checks, technical policies, mailbox rules or external email systems may continue to affect how a message is processed.

More information about managing the allowlist, blocklist and spam filter:

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

 

Why Is an Email in Quarantine?

Spam and threat protection assesses messages based on various technical criteria.

These may include:

  • Sender, domain and IP reputation
  • SPF, DKIM and DMARC checks
  • Links and attachments
  • Message structure and content
  • Sending behaviour and sending patterns
  • Known spam or malicious characteristics

Messages from well-known companies or expected senders may also be classified as spam. The spam filter evaluates the technical characteristics of the respective message and not solely how well known the sender is.

 

Possible Results of the Spam Check

Not every message classified as spam is automatically moved to quarantine.

Depending on the assessment and active policies, a message may be processed in different ways:

  • The message is rejected during transmission. The sending mail server receives an error message.
  • The message is accepted and moved to server-side quarantine.
  • The message is delivered but marked as spam or moved to the Junk or Spam folder.

In addition, local or server-side mailbox rules may move or delete messages that have already been delivered.

More information about spam filter policies:

https://www.green.ch/en/hosted-exchange-spam-filter-policies

 

SpamLab or Quarantine Link Does Not Work

Links in SpamLab reports refer to the respective reported messages in quarantine.

These links generally work only while the relevant message is still in quarantine.

If the message has already been released, deleted, moved or removed because of the retention period, the link can no longer find the message.

A SpamLab link that does not work therefore does not automatically mean that there is a problem with quarantine.

  1. Sign in with a user account that has administrator permissions.
  2. Open the Email Threat Protection section.
  3. Open Quarantine.
  4. Search for the relevant message directly in quarantine.
  5. Check the message and release it if necessary.

More information:

https://www.green.ch/en/hex-spamlab-links-invalid

Note: If you cannot find the message either via the link or directly in quarantine, contact Support. If possible, have the sender, recipient, date and time of the message ready.

 

Procedure for a Missing Email

If an expected email is missing, check the following areas:

  1. Check the inbox and use the mailbox search.
  2. Check the Junk or Spam folder.
  3. Check quarantine.
  4. Check other mailbox folders.
  5. Check existing local or server-side rules.
  6. Check existing forwarding settings.
  7. Check whether the mailbox is full.
  8. If you use POP, check whether the message has already been retrieved by another device.
  9. In the event of rejection, check the sender’s complete non-delivery report.

Note: If the message cannot be found in the mailbox, Spam folder or quarantine and the cause remains unclear, contact Support. If possible, have the full sender address, full recipient address, date, time, subject and any available error messages ready.

 

Check Email Logs

Administrators can view the available email logs in the Email Threat Protection section.

There you can check:

  • which emails were received
  • which emails were sent
  • which emails were rejected
  • when the respective events occurred

The available logs relate exclusively to messages from or to external domains.

Note: Messages between users in the same Hosted Exchange organisation are not displayed in these logs. If such an analysis is required, further investigation by the platform operator may be necessary.