Manage Hosted Exchange Quarantine

Note: This help article applies only to Hosted Exchange. If you are not sure which email service you use, you can find more information in the following article.

https://www.green.ch/en/which-email-service-do-i-use

Quarantine is part of the server-side spam and threat protection provided by Hosted Exchange. Messages classified as suspicious may be held in quarantine instead of being delivered directly to the mailbox.

Quarantine is managed in the Email Threat Protection section.

Difference Between Quarantine and the Spam Folder

Quarantine is not the same as the Junk or Spam folder in the mailbox.

Quarantine: The message was held by the server-side spam or threat protection and has not yet been delivered to the mailbox.
Junk or Spam folder: The message has already been delivered to the mailbox and was classified as spam or moved to the corresponding folder.

Requirements

To fully manage quarantine and the organisation-wide allowlist and blocklist, you need a user account with administrator permissions.

Access via a link in a SpamLab or quarantine report may be restricted and does not automatically provide all administrator functions.

If you do not have administrator permissions, contact the administrator of your Hosted Exchange organisation.

You can find more information about administrator permissions here:

https://www.green.ch/en/how-do-i-assign-admin-permissions-to-a-user

View Quarantine and Release Emails

Sign in with a user account that has administrator permissions.
Open the Email Threat Protection section.
Open Quarantine.
Search for the relevant message.
Check the sender and the other available message details.
Select the message.
Click Release if you consider the message trustworthy.

After it is released, the message is delivered to the mailbox and is then visible there.

Depending on the available function, you may be able to permanently allow the sender when releasing the message. This can prevent future messages from the same sender from being placed in quarantine again because of the same spam filter check.

You can find more information here:

https://www.green.ch/en/hosted-exchange-release-email-in-edgepilot

Permanently Allow or Block Senders

If messages from a specific sender are regularly held by mistake, administrators can permanently allow the sender using the allowlist.

Unwanted senders or sources can be blocked using the blocklist.

The allowlist and blocklist can contain the following types of entries:

Email addresses
Domains
IP addresses

Entries in the allowlist or blocklist apply to the entire Hosted Exchange organisation and can affect all mailboxes within that organisation.

An allowlist influences spam filtering for the listed sender. However, it does not provide a general guarantee of delivery. Other security checks, technical policies, mailbox rules or external receiving mail systems may still affect how a message is processed.

You can find more information here:

https://www.green.ch/en/how-do-i-manage-my-spam-filter-in-edgepilot

Why Is an Email in Quarantine?

Spam and threat protection evaluates messages based on several technical criteria.

These include:

Sender, domain and IP reputation
SPF, DKIM and DMARC checks
Links and attachments
Message structure and content
Sending behaviour and patterns
Known spam or malicious characteristics

Messages from well-known companies or expected senders can also be classified as spam. The spam filter evaluates the technical characteristics of the individual message, not only how well known the sender is or the sender's relationship with the recipient.

Possible Results of the Spam Check

Not every message classified as spam or not delivered is moved to quarantine.

Depending on the assessment and the active policies, a message may be processed in different ways:

The message is rejected during transmission. The sending mail server receives an error message.
The message is accepted and moved to the server-side quarantine.
The message is delivered but marked as spam or placed in the Junk or Spam folder.

In addition, local or server-side mailbox rules may move or delete a message that has already been delivered.

You can find more information here:

https://www.green.ch/en/hosted-exchange-spam-filter-policies

SpamLab or Quarantine Link Does Not Work

Links in SpamLab or quarantine reports may only be valid temporarily or may become invalid after changes. An invalid link does not automatically mean that the relevant message is no longer available.

In this case, check the message directly in quarantine:

Sign in with a user account that has administrator permissions.
Open the Email Threat Protection section.
Open Quarantine.
Search for the relevant message.
Check the message and release it if necessary.

You can find more information here:

https://www.green.ch/en/hex-spamlab-links-invalid

Note: If you cannot open the message using the link or find it directly in quarantine, contact Support. Provide the sender, recipient, date and the most accurate possible time of the message.

Procedure for a Missing Email

If an expected email is missing, check the following areas:

Check the inbox and use the mailbox search function.
Check the Junk or Spam folder.
Check quarantine.
Check other folders in the mailbox.
Check existing local and server-side mailbox rules.
Check existing forwarding settings.
Check whether the mailbox is full.
If you use POP, check whether the message has already been retrieved by another device.
If the message was rejected, check the sender's complete non-delivery report.

Note: If the expected message cannot be found in the mailbox, the Junk or Spam folder, or quarantine, and the cause remains unclear, contact Support.

Have the following information ready for the investigation whenever possible:

Full sender address
Full recipient address
Date of the message
The most accurate possible time
Subject or description of the missing message
Complete non-delivery report if the sender received an error message