# How do you set up and manage the Gmail admin quarantine in Google Workspace?

URL: https://iblockspam.com/blog/google-workspace-admin-quarantine
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> How Gmail admin quarantine works in Google Workspace: default and custom quarantines, reviewers, allow and deny, notifications and the 30-day retention limit.

## Short answer

Gmail's admin quarantine holds messages caught by spam, compliance, routing or safety settings for review. Every account has a default quarantine; super admins can add custom ones with reviewer groups and denial actions. Reviewers allow or deny messages at admin.google.com/ac/moderation. Recipients are never notified, and unhandled messages are deleted 30 days after sending.

Google Workspace can hold suspicious mail in an admin quarantine instead of delivering it to a user's Inbox or Spam folder. It's a useful safety net for spam, risky attachments and payment-change requests, but it's built for admins and appointed reviewers, not for end users. This guide covers how to set quarantines up, who can review them, and the limits that catch people out.

Our [Gmail spam settings guide](https://iblockspam.com/blog/gmail-spam-settings-google-workspace) introduces quarantine as one option among many. This guide goes deeper on running it day to day. For the general idea, see [what an email quarantine is](https://iblockspam.com/blog/what-is-email-quarantine).

## What is the Gmail admin quarantine?

Email quarantine is part of the Google Workspace Moderation Tool. Google says it lets admins "create settings that send incoming and outgoing email messages to a quarantine before they're delivered to recipients" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine)). A reviewer can then see which setting caught the message, release it, or block it and optionally tell the sender.

Nothing goes to quarantine by default. A message arrives there only because a setting with a quarantine action matched it:

| Setting | Example use | Sender notification option |
|---|---|---|
| **Spam** (Put spam in administrative quarantine) | Hold everything Gmail judges to be spam | Not listed |
| **Content compliance** | Payment-change wording, sensitive data, spoofed own domain | Yes, for your own senders' internal messages |
| **Attachment compliance** | Risky file types, encrypted archives | Yes, for your own senders' internal messages |
| **Objectionable content** | Listed words | Not listed |
| **Routing** | Mail from a domain that has attacked you before | Yes, for your own senders' internal messages |
| **Safety** settings with the Quarantine action | Domain spoofing, employee name spoofing, anomalous attachments | Not listed |

The first five come from Google's [quarantine setup page](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine). The Safety settings are covered in our [advanced phishing and malware protection guide](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection). One detail matters there: Google says that for Safety settings, "Allowlist settings don't override the Quarantine option" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)).

## Default vs custom quarantines

Every Google Workspace account has one **default quarantine**. Any setting that quarantines without naming a custom quarantine sends messages there. If you delete a custom quarantine that still holds messages, they move to the default one.

Super admins can create **custom quarantines** to:

- Separate different kinds of catches, for example one for risky attachments and one for payment changes.
- Give a specific group access to just that quarantine, which Google calls a **restricted quarantine**.
- Send a rejection notice to senders when a message is denied.
- Send periodic notifications to super admins.

Google says the default quarantine may be enough for an organization that's "relatively small or doesn't send or receive a lot of email." We'd still create at least two custom quarantines: one for spam and one for security catches that a person must look at. Mixing a day's spam with one fake invoice is how the invoice gets missed.

## How do you create a custom quarantine?

You must be signed in as a super administrator ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine)).

1. In the Admin console, go to **Menu** > **Apps** > **Google Workspace** > **Gmail** > **Manage quarantines**.
2. Select **Add Quarantine**.
3. Enter a **Name** that describes what lands there, such as `Payment change review`. It appears next to each message in the dashboard.
4. Optionally add a **Description**.
5. Optionally choose a **Quarantine reviewers group**. Without one, only super admins and admins with the **Access Admin Quarantine** privilege can see it.
6. Choose the **Inbound denial consequence** and **Outbound denial consequence**: **Drop message** (deleted, sender not told) or **Send the default reject message** (deleted, sender gets a rejection).
7. Optionally tick **Notify periodically when messages are quarantined**.
8. Select **Save**. Changes can take up to 24 hours.

Then point settings at it. Create the quarantine before the setting, because each setting must name its quarantine. You can't delete a custom quarantine while a setting still references it.

### Choosing the denial consequence

For inbound spam and phishing, choose **Drop message**. Sending rejection notices to spammers produces [backscatter](https://iblockspam.com/blog/backscatter-spam-bounce-messages), and phishers learn nothing useful from silence. For outbound or internal rules, such as data protection, **Send the default reject message** tells your own staff why their message didn't go.

Google notes some quirks of the reject message. Each **Deny** action sends one notice per sender, so select all of a sender's messages before you deny. The notice includes the original subject, so if the subject triggered the rule, the notice itself may be quarantined. And reject messages for denied inbound group messages are dropped even when the option is set.

## Who can review quarantined messages?

Google offers two models ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/give-your-users-access-to-email-quarantine)):

| Model | How to set it up | Reviewer sees |
|---|---|---|
| All quarantines | A custom admin role with the **Access Admin Quarantine** privilege | Every message in every quarantine |
| Restricted quarantines | A custom role with **Access restricted quarantines**, plus membership in a group that's set as the quarantine's reviewers | Only the quarantines their group is assigned to |

Only a super admin can create these roles, under **Account** > **Admin roles** > **Create new role**, with the privilege found under **Gmail**. You then assign the role from **Directory** > **Users** or from the role itself, up to 20 users at a time.

Either way, a reviewer sees other people's mail. Choose reviewers as carefully as you'd choose anyone with mailbox access, and prefer restricted quarantines. A finance lead reviewing **Payment change review** doesn't need to see HR's quarantine.

## How do you review, allow and deny messages?

Open the dashboard from **Gmail** > **Manage quarantines** > **Go to Quarantine**, or go to `admin.google.com/ac/moderation` ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/manage-quarantined-messages)). You'll see the quarantines your role and groups allow.

1. **Filter.** The default view is all quarantines with status **Pending triage**. Filter by **Quarantine** or by **Status** (**Pending triage**, **Denied**, **Allowed**).
2. **Search.** Search covers headers and body and accepts Gmail search operators, within the current filters.
3. **Check why it was caught.** Point at a message to see the rule description, quarantine name, the **Source** that matched and the **Matched string**, when Gmail can show them.
4. **Read the full message safely.** Expand the entry and select **Show Original** to see all headers. Paste them into our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to check SPF, DKIM and DMARC.
5. **Act.** Tick one or more messages and select **Allow** or **Deny**. Google is clear that "you can't undo the action."

### What reviewers should check before allowing

- [ ] Did the message pass authentication for the From domain?
- [ ] Is the sender someone you actually deal with, at their usual address?
- [ ] Do links point where the text says? Hover, don't click.
- [ ] For payment or bank-detail changes, has someone confirmed by phone using a number already on file?
- [ ] Is the attachment type expected from this sender?

If in doubt, deny. A real sender can resend. A released phishing message can't be taken back, and the recipient now has it with your approval implied.

### Things that surprise new reviewers

- An inbound message with five recipients appears in the quarantine five times, once per recipient.
- A message can sit in several quarantines at once. The deny result depends on which quarantine you act from, so one copy might be dropped silently while another sends a rejection notice.
- A message you release from the spam quarantine "is checked against Gmail spam filters again" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/add-custom-spam-filters-to-gmail)), so it may land in the user's Spam folder.
- Outgoing messages that are quarantined still show in the sender's Sent folder.

## How long are quarantined messages kept?

Google keeps quarantined messages "up to 30 days after sending," then deletes them permanently, and "messages deleted from quarantine can't be recovered by admins or users" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine)). That applies to messages left pending and to denied messages. If you use Google Vault or other storage with longer retention, copies remain there until that retention ends.

Note that the clock starts at sending, not quarantining. A message caught on a Friday before a long weekend has fewer days left than you might think, which is another reason to review daily.

## Notifications and their limits

Google's notification options are narrow:

| Who | Notified? |
|---|---|
| Recipients | Never. Google says "recipients are never notified when a message is quarantined." |
| Super admins | Optional, with **Notify periodically when messages are quarantined**: sent within an hour, at most one per hour, with counts per quarantine |
| Other reviewers (role or group) | Not by that setting; they must check the dashboard |
| External senders | Only if a reviewer denies the message from a quarantine set to **Send the default reject message** |
| Your own senders | Some compliance and routing settings offer **Notify sender when mail is quarantined** for internal messages |

Because reviewers aren't notified, put a recurring task in someone's calendar. A quarantine that nobody opens is a 30-day delete queue.

## What can't be quarantined?

Google lists these exceptions:

- Messages sent to Google Groups.
- Messages to or from suspended or deactivated accounts.
- Outgoing messages where the sender requested S/MIME encryption are rejected instead of quarantined.

Google also warns that when a group or list message is quarantined, "a copy of the message is quarantined for each recipient," which can produce a large number of quarantined messages.

## When is Gmail's quarantine the wrong tool?

Gmail's quarantine is centralized by design. Users can't see what's held for them, can't release their own newsletters, and get no digest. That's fine for high-risk catches that a trained person should judge. It's a poor fit for routine spam, where users are best placed to spot the one real message among the noise.

A filtering gateway in front of Google Workspace can split the two jobs. iBlockSpam, for example, gives every user a personal quarantine with scheduled digest emails, plus a domain-wide shared quarantine for admins; see [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests). You can then keep Gmail's admin quarantine for the compliance rules that need a specialist's eye.

## Next steps

1. Create custom quarantines for spam and for security catches, with restricted reviewer groups.
2. Set **Drop message** as the inbound denial consequence for spam and phishing quarantines.
3. Point your high-risk rules at the right quarantine. Our [content compliance rules guide](https://iblockspam.com/blog/google-workspace-content-compliance-rules) has three to start with.
4. Schedule a daily review, and turn on super admin notifications as a backstop.
5. Use [Email Log Search](https://iblockspam.com/blog/google-workspace-email-log-search) when a user says a message never arrived and it isn't in quarantine.

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### How long does Google Workspace keep quarantined email?

Google keeps quarantined messages up to 30 days after they were sent, then deletes them permanently, whether they were pending review or denied. Deleted messages can't be recovered by admins or users. If you use Google Vault or other storage with longer retention, copies remain available there until that retention period ends.

### Can regular Google Workspace users see their own quarantined email?

Not as a self-service inbox. Access is granted through admin roles: a custom role with Access Admin Quarantine sees every quarantine, and Access restricted quarantines plus a reviewers group limits someone to chosen quarantines. Either way, the person reviews mail for the organization in the quarantine dashboard, not just their own.

### Are recipients told when Gmail quarantines their email?

No. Google states that recipients are never notified when a message is quarantined. Super admins can opt into periodic notifications, sent at most once an hour, and senders hear only if a reviewer denies the message from a quarantine set to Send the default reject message.

### Why did a released quarantine message land in Spam?

When you release a message that was quarantined by the Put spam in administrative quarantine setting, Gmail checks it against its spam filters again, so it can still go to the recipient's Spam folder. Google's quarantine help says recipients who can't find a released message should check Spam.

### What messages can't Gmail quarantine?

Google says messages sent to Groups can't be quarantined, and neither can messages to or from suspended or deactivated accounts. When a group or list message is quarantined for its members, a copy is held for each recipient, so large lists can flood a quarantine.

## Sources

- [Google Workspace Admin Help: Set up email quarantine](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-email-quarantine)
- [Google Workspace Admin Help: Manage quarantined messages](https://knowledge.workspace.google.com/admin/gmail/advanced/manage-quarantined-messages)
- [Google Workspace Admin Help: Give your users access to email quarantine](https://knowledge.workspace.google.com/admin/gmail/advanced/give-your-users-access-to-email-quarantine)
- [Google Workspace Admin Help: Customize Gmail's default spam filtering](https://knowledge.workspace.google.com/admin/gmail/advanced/add-custom-spam-filters-to-gmail)
- [Google Workspace Admin Help: Advanced phishing and malware protection](https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection)
- [Google Workspace Admin Help: Set up rules for advanced email content filtering](https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-for-advanced-email-content-filtering)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-admin-quarantine (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt