Email security basics

What is an email quarantine, and how should you use it?

By iBlockSpam Team How we check our guides Updated Oct 9, 2026 8 min read 5 sources

Short answer

An email quarantine is a holding area where a spam filter keeps suspicious messages instead of delivering them. Users or admins can review, release or delete them. Most services keep quarantined mail for a limited time, often 15 to 30 days, then delete it permanently. Digest emails tell users what's waiting so real mail isn't missed.

On this page 10 sections

A spam filter has three choices for a suspicious message: deliver it, reject it, or hold it somewhere safe. Quarantine is the third option. This guide explains how quarantine works, who should see what, and how to release mail without undoing the protection.

What is an email quarantine?

An email quarantine is a holding area outside the mailbox. When a filter thinks a message is spam, phishing or malware, but isn't certain enough to reject it outright, it stores the message in quarantine instead of the inbox. Someone can then look at it and decide.

Microsoft describes its quarantine as available "to hold potentially dangerous or unwanted messages" (Microsoft Learn). Every quarantine has the same basic parts:

A reason. Why the message was held: spam, bulk, phishing, malware, a policy rule.
A list. Somewhere to see held messages, usually a web portal.
Actions. Release, delete, preview, and often allow or block the sender.
An expiry. Messages are deleted automatically after a set time.

How is quarantine different from the junk folder?

Item	Junk folder	Quarantine
Where the message is	Inside the mailbox	Outside the mailbox
Was it delivered?	Yes	No, until released
Who can open it	The mailbox owner	Depends on policy: user, admin or both
Risk of clicking a bad link	Higher: it's in the mail client	Lower: previews usually disable links
Typical use	Likely spam, low risk	Phishing, malware, high-confidence spam

The difference matters for phishing. A phishing email in Junk is still in the mailbox, still searchable, and still has working links. In a quarantine preview, Microsoft shows the message "with all links disabled" (Microsoft Learn).

Personal quarantine vs admin quarantine

Most filtering services offer two views of the same held mail.

Personal (user) quarantine

Each user sees messages that were addressed to them. They can usually release obvious false positives, such as a newsletter they signed up for, without asking IT. This keeps the help desk quiet and gets real mail delivered quickly.

Admin (shared) quarantine

Admins see everything held for the whole domain. They can search across users, release messages users can't, and spot patterns, such as one supplier's invoices being held every week.

Who should be allowed to release what?

The safest model is to let users handle low-risk categories and keep dangerous ones admin-only. Microsoft 365 works this way by default: users can view, release and delete their own messages quarantined as spam, bulk, phishing and impersonation, but "only admins can work with messages that were quarantined as malware or high confidence phishing" (Microsoft Learn). Where policy allows, users can only request release for those messages. Our guide to releasing quarantined email in Microsoft 365 walks through each method.

Category	Suggested user permission	Why
Bulk and marketing	Release	Low risk, often wanted
Spam	Release	Usually harmless if wrong
Phishing (normal confidence)	Request release	Real risk; a second look helps
High-confidence phishing	Admin only	Released phishing is how accounts get stolen
Malware	Admin only	Releasing malware defeats the filter

Google Workspace takes a different approach to admin quarantine. Only super admins and admins given quarantine privileges can review it, and recipients "are never notified when a message is quarantined" (Google Workspace Admin Help).

What are quarantine digest emails?

A quarantine that nobody checks becomes a black hole. Real invoices sit there until they expire. Digest emails fix this. A digest is a periodic summary sent to each user, listing what's waiting in their quarantine, usually with a link to review or release each item.

Digest frequency is a trade-off:

Hourly or every few hours. Good for sales, support and finance, where a held inquiry or invoice costs money.
Daily. A sensible default for most people.
Weekly. Fine for low-volume mailboxes and roles that rarely get external mail.

In Microsoft 365, quarantine notifications can be sent within 4 hours, daily or weekly. They're controlled by quarantine policies, and they're turned off in the default policies except the one used by the preset security policies (Microsoft Learn). If you've never changed these settings, your users probably don't get any digest at all.

Digests carry a risk of their own: criminals can copy them. A fake "You have 5 held messages" email with a credential-harvesting link is easy to build. Teach users to open the quarantine portal directly, from a bookmark, rather than trusting any digest link that asks for a password.

How long does quarantine keep messages?

Every quarantine has a retention limit, and expired messages are gone for good.

Platform and category	Default retention	Notes
Microsoft 365: spam, bulk, phishing (default anti-spam policy)	15 days	Configurable from 1 to 30 days
Microsoft 365: same categories in Standard or Strict preset	30 days	Not changeable
Microsoft 365: malware	30 days	Not changeable
Google Workspace admin quarantine	Up to 30 days	Then permanently deleted

Sources: Microsoft Learn, Google Workspace Admin Help.

Microsoft is blunt: when messages expire from quarantine, they're "permanently deleted and can't be recovered." Google says the same. Retention is why digests matter. If nobody looks for 15 days, a held message never arrives.

Should a filter reject mail or quarantine it?

Rejecting a message during the SMTP conversation means it never enters your system. The sending server gets an error and, if it's a real mail server, tells the sender the message bounced. Quarantining means you accept the message and hold it quietly.

Each has a place:

Reject when the filter is very confident and there's nothing to review: known malware, mail from blocked senders, or messages that fail a sender's DMARC p=reject policy. The real sender, if there is one, finds out straight away.
Quarantine when there's a reasonable chance the message is wanted: likely spam, suspected phishing from a known contact, or a new supplier's first invoice. A human can rescue it.
Junk folder only for low-risk mail, such as bulk newsletters, where convenience matters more than safety.

Denying a message after review is different again. In Google Workspace, an admin who denies a quarantined message can either drop it silently or send the sender a default reject message (Google Workspace Admin Help). Silent drops are kinder to your inbox but leave a genuine sender guessing.

What are the risks of releasing quarantined email?

Releasing a message delivers it to the inbox, links and attachments included. Most phishing that "gets through" a well-configured filter does so because someone released it.

Common mistakes:

Releasing because the sender looks familiar. Display names are trivial to fake. Look at the actual address and domain.
Releasing because the user is expecting an invoice. Criminals time invoice fraud to match real ones. See our guide to business email compromise.
Allowing the sender while releasing. A one-off release is one message. An allow-list entry lets everything from that sender skip checks, including the next spoof.
Bulk-releasing to clear a backlog. Batch release is how one phishing message rides along with twenty newsletters.

A safe release checklist

Read the quarantine reason. Spam or bulk is low risk. Phishing, spoof, impersonation or malware needs a closer look.
Check the real sender. Compare the From address with past mail from the same person. Watch for lookalike domains.
Check authentication. View the headers and look for SPF, DKIM and DMARC results. Paste them into the Email Header Analyzer if they're hard to read.
Ask whether you expected it. If it asks you to pay, log in, or open an unexpected attachment, confirm with the sender by phone first.
Release only that message. Don't add an allow-list entry unless the same legitimate sender is held repeatedly.
Report false positives. Most services let you report a release as "not junk." That improves filtering for everyone on the domain.
Escalate if unsure. Request release, or ask IT, rather than guessing.

How should a small business set up quarantine?

Quarantine the dangerous categories. Send phishing, spoofing, impersonation and malware to quarantine rather than Junk.
Keep high-risk categories admin-only. Users can release spam and bulk. Admins handle the rest.
Turn on digests. Daily for most people, more often for roles that can't miss mail.
Set retention as long as the platform allows. In Microsoft 365, raise anti-spam quarantine retention from the default 15 days to 30 in the default and any custom anti-spam policies.
Review the admin quarantine weekly. Look for repeat false positives and fix the cause with a sender rule, not a blanket allow. Our guide to false positives explains how.
Tell users what a real digest looks like. And remind them to reach quarantine from a bookmark.

How quarantine works in iBlockSpam

iBlockSpam filters mail at the MX level, before it reaches Microsoft 365, Google Workspace or your own server. Every user gets a personal quarantine with scheduled digest emails: hourly, daily, on a chosen weekday, or a custom schedule. Admins get a domain-wide shared quarantine. Message history is kept for 30 days. See quarantine and digests for details.

Next steps

Find out where your users' quarantine is and whether they get digests. If they don't, turn them on.
Check which quarantine categories users can release themselves, and lock down malware and high-confidence phishing.
Write the safe release checklist above into your IT guidance.
To see how a domain-level filter with personal quarantines fits in front of your mail platform, read how it works.

You can click through a sample customer portal, with held-mail counts per domain, in the iBlockSpam portal demo; the quarantine itself is described on our quarantine and digests page.

Frequently asked questions

Is a quarantine the same as a junk folder?

No. A junk folder is inside the mailbox, so the message has been delivered and its links and attachments are one click away. A quarantine holds the message outside the mailbox. It reaches the user only if someone releases it, which makes quarantine the safer place for likely phishing and malware.

How long are emails kept in quarantine?

It depends on the service. In Microsoft 365, quarantined spam is kept for 15 days by default in the default anti-spam policy, configurable from 1 to 30 days, and malware for 30 days. Google Workspace keeps admin quarantine messages for up to 30 days. Expired messages are deleted permanently.

Are senders told when their email is quarantined?

Usually not. Google Workspace says recipients are never notified when a message is quarantined, and the sender only hears about it if an admin denies the message with a reject notice. Most filters quarantine silently, which is why digest emails for recipients matter.

Is it safe to release an email from quarantine?

Only when you're sure it's legitimate. Check the real sender address, the authentication results and whether you expected the message. Never release mail flagged as malware or high-confidence phishing on a hunch. If in doubt, confirm with the sender by phone or ask your admin.

Can users see everything in quarantine?

Not always. Admins usually see all quarantined mail. Users see only their own, and often not every category. In Microsoft 365, by default, messages quarantined as malware or high confidence phishing are only available to admins and aren't visible to users.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading