How do you set up and manage the Gmail admin quarantine in Google Workspace?

Google Workspace can hold suspicious mail in an admin quarantine instead of delivering it to a user's Inbox or Spam folder. It's a useful safety net for spam, risky attachments and payment-change requests, but it's built for admins and appointed reviewers, not for end users. This guide covers how to set quarantines up, who can review them, and the limits that catch people out.

Our Gmail spam settings guide introduces quarantine as one option among many. This guide goes deeper on running it day to day. For the general idea, see what an email quarantine is.

What is the Gmail admin quarantine?

Email quarantine is part of the Google Workspace Moderation Tool. Google says it lets admins "create settings that send incoming and outgoing email messages to a quarantine before they're delivered to recipients" (Google Workspace Admin Help). A reviewer can then see which setting caught the message, release it, or block it and optionally tell the sender.

Nothing goes to quarantine by default. A message arrives there only because a setting with a quarantine action matched it:

The first five come from Google's quarantine setup page. The Safety settings are covered in our advanced phishing and malware protection guide. One detail matters there: Google says that for Safety settings, "Allowlist settings don't override the Quarantine option" (Google Workspace Admin Help).

Default vs custom quarantines

Every Google Workspace account has one default quarantine. Any setting that quarantines without naming a custom quarantine sends messages there. If you delete a custom quarantine that still holds messages, they move to the default one.

Super admins can create custom quarantines to:

• Separate different kinds of catches, for example one for risky attachments and one for payment changes.
• Give a specific group access to just that quarantine, which Google calls a restricted quarantine.
• Send a rejection notice to senders when a message is denied.
• Send periodic notifications to super admins.

Google says the default quarantine may be enough for an organization that's "relatively small or doesn't send or receive a lot of email." We'd still create at least two custom quarantines: one for spam and one for security catches that a person must look at. Mixing a day's spam with one fake invoice is how the invoice gets missed.

How do you create a custom quarantine?

You must be signed in as a super administrator (Google Workspace Admin Help).

1. In the Admin console, go to Menu > Apps > Google Workspace > Gmail > Manage quarantines.
2. Select Add Quarantine.
3. Enter a Name that describes what lands there, such as Payment change review. It appears next to each message in the dashboard.
4. Optionally add a Description.
5. Optionally choose a Quarantine reviewers group. Without one, only super admins and admins with the Access Admin Quarantine privilege can see it.
6. Choose the Inbound denial consequence and Outbound denial consequence: Drop message (deleted, sender not told) or Send the default reject message (deleted, sender gets a rejection).
7. Optionally tick Notify periodically when messages are quarantined.
8. Select Save. Changes can take up to 24 hours.

Then point settings at it. Create the quarantine before the setting, because each setting must name its quarantine. You can't delete a custom quarantine while a setting still references it.

Choosing the denial consequence

For inbound spam and phishing, choose Drop message. Sending rejection notices to spammers produces backscatter, and phishers learn nothing useful from silence. For outbound or internal rules, such as data protection, Send the default reject message tells your own staff why their message didn't go.

Google notes some quirks of the reject message. Each Deny action sends one notice per sender, so select all of a sender's messages before you deny. The notice includes the original subject, so if the subject triggered the rule, the notice itself may be quarantined. And reject messages for denied inbound group messages are dropped even when the option is set.

Who can review quarantined messages?

Google offers two models (Google Workspace Admin Help):

Only a super admin can create these roles, under Account > Admin roles > Create new role, with the privilege found under Gmail. You then assign the role from Directory > Users or from the role itself, up to 20 users at a time.

Either way, a reviewer sees other people's mail. Choose reviewers as carefully as you'd choose anyone with mailbox access, and prefer restricted quarantines. A finance lead reviewing Payment change review doesn't need to see HR's quarantine.

How do you review, allow and deny messages?

Open the dashboard from Gmail > Manage quarantines > Go to Quarantine, or go to admin.google.com/ac/moderation (Google Workspace Admin Help). You'll see the quarantines your role and groups allow.

1. Filter. The default view is all quarantines with status Pending triage. Filter by Quarantine or by Status (Pending triage, Denied, Allowed).
2. Search. Search covers headers and body and accepts Gmail search operators, within the current filters.
3. Check why it was caught. Point at a message to see the rule description, quarantine name, the Source that matched and the Matched string, when Gmail can show them.
4. Read the full message safely. Expand the entry and select Show Original to see all headers. Paste them into our Email Header Analyzer to check SPF, DKIM and DMARC.
5. Act. Tick one or more messages and select Allow or Deny. Google is clear that "you can't undo the action."

What reviewers should check before allowing

• Did the message pass authentication for the From domain?
• Is the sender someone you actually deal with, at their usual address?
• Do links point where the text says? Hover, don't click.
• For payment or bank-detail changes, has someone confirmed by phone using a number already on file?
• Is the attachment type expected from this sender?

If in doubt, deny. A real sender can resend. A released phishing message can't be taken back, and the recipient now has it with your approval implied.

Things that surprise new reviewers

• An inbound message with five recipients appears in the quarantine five times, once per recipient.
• A message can sit in several quarantines at once. The deny result depends on which quarantine you act from, so one copy might be dropped silently while another sends a rejection notice.
• A message you release from the spam quarantine "is checked against Gmail spam filters again" (Google Workspace Admin Help), so it may land in the user's Spam folder.
• Outgoing messages that are quarantined still show in the sender's Sent folder.

How long are quarantined messages kept?

Google keeps quarantined messages "up to 30 days after sending," then deletes them permanently, and "messages deleted from quarantine can't be recovered by admins or users" (Google Workspace Admin Help). That applies to messages left pending and to denied messages. If you use Google Vault or other storage with longer retention, copies remain there until that retention ends.

Note that the clock starts at sending, not quarantining. A message caught on a Friday before a long weekend has fewer days left than you might think, which is another reason to review daily.

Notifications and their limits

Google's notification options are narrow:

Because reviewers aren't notified, put a recurring task in someone's calendar. A quarantine that nobody opens is a 30-day delete queue.

What can't be quarantined?

Google lists these exceptions:

• Messages sent to Google Groups.
• Messages to or from suspended or deactivated accounts.
• Outgoing messages where the sender requested S/MIME encryption are rejected instead of quarantined.

Google also warns that when a group or list message is quarantined, "a copy of the message is quarantined for each recipient," which can produce a large number of quarantined messages.

When is Gmail's quarantine the wrong tool?

Gmail's quarantine is centralized by design. Users can't see what's held for them, can't release their own newsletters, and get no digest. That's fine for high-risk catches that a trained person should judge. It's a poor fit for routine spam, where users are best placed to spot the one real message among the noise.

A filtering gateway in front of Google Workspace can split the two jobs. iBlockSpam, for example, gives every user a personal quarantine with scheduled digest emails, plus a domain-wide shared quarantine for admins; see quarantine and digests. You can then keep Gmail's admin quarantine for the compliance rules that need a specialist's eye.

Next steps

1. Create custom quarantines for spam and for security catches, with restricted reviewer groups.
2. Set Drop message as the inbound denial consequence for spam and phishing quarantines.
3. Point your high-risk rules at the right quarantine. Our content compliance rules guide has three to start with.
4. Schedule a daily review, and turn on super admin notifications as a backstop.
5. Use Email Log Search when a user says a message never arrived and it isn't in quarantine.

Browse more guides on running email day to day.