Spam Quarantine - Zoho Mail

Spam Quarantine

The Spam Quarantine section in the Zoho Mail Admin Console lists all the emails that have been quarantined as a result of the spam processing configured. From the quarantine section, admins can choose to deliver or deny the emails. Further, notifications can also be configured for the quarantined emails to ensure that they are not missed.

Quarantined Emails

The quarantine is the section, where the emails, which may be considered as spam due to any validation failure or based on organization or Zoho blocklist, can be optionally moved for review by the administrator based on the spam processing settings.

To access and moderate the quarantined emails,

  1. Login to the Zoho Mail Admin Console.
  2. Go to the Security & Compliance menu, and select Quarantine .
  3. In the Quarantined Emails tab, you will see the emails awaiting moderation.
  4. You can also click on an email to view its contents and the email headers in detail.
  5. Then, you can select the emails that you'd like to Deliver or Deny and click on the respective option.

Delivering emails

When you select one or more emails to deliver, you can choose how you want to deliver them.

Deliver action enhancement

  • Deliver selected - Only those quarantined emails you selected will be delivered.
  • Deliver & Add - Select this option if you wish to add an email address/ domain to the Allowed/Trusted list simultaneously while delivering a quarantined email. After the email is delivered, the email address/domain will be added to the Allowed/Trusted list depending on the quarantine reason. A dialog box will be displayed asking you to confirm if you wish to add the email address/domain to the Allowed/Trusted list (Refer to the table below for more details). 
  • Deliver All - All the quarantined emails will be delivered.

Denying emails

While denying quarantined emails, you can choose from one of the four options.

deny action enhancements

  • Deny selected- Only those quarantined emails you selected will be denied.
  • Deny & Add- Select this option if you wish to add an email address/ domain to the blocked list simultaneously while denying a quarantined email. After the email is denied, the email address/domain will be added to the blocked list depending on the quarantine reason. A dialog box will be displayed asking you to confirm if you wish to add the email address/domain to the blocked list (Refer to the table below for more details). 
  • Deny & Notify- Selecting this option will notify the sender of the email that you have denied their email. A dialog box will be displayed asking you to confirm if you wish to send en email notification to the sender that their emails have been denied.
  • Deny All- All the quarantined emails will be denied.

Note:

You should select only one email at a time for the Deny & Notify option to appear. The option won't appear if you select multiple emails.

The table lists the different reasons an email can be quarantined and how the sender email/domain to the allowed/blocked list based on the quarantined reason. 

Quarantined reasonOn Deliver actionOn Deny action
SPF FailThe domain gets added to the Trusted Domains list.The domain gets added to the Blocked Domains list with Reject action.
SPF Soft FailThe domain gets added to the Trusted Domains list.The domain gets added to the Blocked Domains list with Reject action.
DKIM FailThe domain gets added to the Trusted Domains list.The domain gets added to the Blocked Domains list with Reject action.
DMARC FailThe domain gets added to the Trusted Domains list.The domain gets added to the Blocked Domains list with Reject action.
DNSBLThe domain gets added to the Trusted Domains list.The domain gets added to the Blocked Domains list with Reject action.
Blocked EmailThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Blocked DomainThe domain gets added to the Allowed Domains list.The domain gets added to the Blocked Domains list with Reject action.
Blocked TLDThe domain gets added to the Allowed Domains list.The domain gets added to the Blocked Domains list with Reject action.
Blocked IPThe email address gets added to the Allowed emails list.The domain gets added to the Blocked Domains list with Reject action.
Cousin Domain SpamThe domain gets added to the Allowed Domains list.The domain gets added to the Blocked Domains list with Reject action.
Blocked sender patternThe domain gets added to the Allowed Domains list.The domain gets added to the Blocked Domains list with Reject action.
Blocked subject patternThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Blocked content patternThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Display Name SpoofingThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Quarantined CountryThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Blocked recipientThe email address gets added to the Allowed emails list.The email address gets added to the Blocked emails list with Reject action.
Org spam settingsThe email address gets added to the Trusted emails list.The email address gets added to the Blocked emails list with Reject action.

You can also search for specific quarantined emails based on the available criteria. The search can be performed based on criteria such as Subject, Sender, To or Cc, Email Content, Attachment Name, Attachment Content or Date. By default, the entire message will be searched. 

quarantined emails

Further, you can also use the Filter option to select the particular validation failure of quarantined emails and filter out those emails which matches the criteria.

filter quarantined emails

A notification email can be sent to the recipient of the quarantined email and a selected admin each time an email is quarantined.

 The quarantine section should be monitored regularly, and if there is a particular pattern in legitimate emails being quarantined, the spam processing settings of the organization can be adjusted accordingly.

Previewing quarantined emails

While previewing quarantined emails, you can choose between the original content format or the email content format from the Settings. The administrators who have access to the quarantined emails can change the preview type for the organization.

By default, the emails are displayed in the original format. Once you choose your preferred format, the selected format will be applied across the organization.

Steps to change the email preview type

  1. Login to the Zoho Mail Admin Console as an administrator.
  2. Go to the Security & Compliance menu, and select Quarantine .
  3. Go to Settings.
  4. Select between Show Original or Show Email preview type. The chosen preview type is now applied across the organization.

changing preview type

Note:

You can also change views from the email preview but that's temporary and won't be applied across the entire organization.

email content preview

Quarantine Notifications:

When an email is quarantined due to the failure of any of the spam checks, the admin can choose to trigger a notification email. This email will be sent to the recipient to whom the quarantined email is addressed, and a copy will be sent to all the selected admins.

Similarly, when an email that is sent to a group is quarantined, the notification email will be sent to the group moderator. If the group does not have a moderator, it will be sent to the organization admin. 

The notification email will contain details such as the sender of the quarantined email, the email subject, the date and time at which the email was sent and the reason why it was quarantined.

To set up quarantine notifications, 

  1. Login to the Zoho Mail Admin Console.
  2. Go to the Security & Compliance menu, and select Quarantine .
  3. Go to the Notification Settings tab.
  4. Switch the toggle across Send email notification to ON
  5. Select how often you'd like to receive notifications from the Notification email frequency dropdown.
  6. Click   and add the admins you'd like to notify about quarantined emails.

quarantine notification settings

Based on the frequency set, an email containing the details of all the quarantined emails in that duration will be sent to the selected admins and the relevant email recipients.

Self moderators

Aside from administrators being able to manage the quarantined emails, you can also assign your organization users as self moderators to approve the quarantined emails. However, the self moderators will only be able to approve those quarantined emails that are addressed to them. If a particular quarantined email contains multiple recipients, the email will be delivered only to the user who approves it. 

For example, say there are two users named Rebecca and Paula, and Rebecca has been assigned as a moderator. There's a quarantined email from a sender id name@company1.com addressed to them both. If Rebecca approves the email, the email will be delivered only to her.

To add a self moderator, 

  1. Login to the Zoho Mail Admin Console.
  2. Go to the Security & Compliance menu, select Quarantine and select Self moderators.
  3. Click on the Add button (+). The self moderators pop-up window opens.
    add a self moderator
  4. A list of your organization users will be displayed in the window. As you click on a user, they will be added to the Selected users portion of the window. You can also search for users using the search bar in the pop-up window.
  5. After selecting the users, click Proceed
  6. To quickly remove any user from the window, click on the Delete icon next to the user. To remove all the users you've added from the window, click on Remove All.
    adding a moderator

You can also delete users from the self-moderators position should you wish. To delete a self-moderator,

  1. In the Self moderators tab, click on the user who you wish to remove. To remove multiple users, select them all.
  2. Click on the Delete button displayed above the list.
  3. You can also delete individual users by clicking on the Deleteicon appearing next to each user when you hover over them.
    delete moderator

Note:

If the admin denies an email before the self-moderator could approve and deliver it to their inbox, the self-moderator can't approve the email later. 

Delivered and Denied Emails

In the Zoho Mail Admin Console, the quarantined emails that have been approved or rejected can be viewed under Delivered Emails and Denied Emails respectively in the Quarantine section. All the information including the reason for quarantine and the date the emails were quarantined gets listed so that you can always have a complete record of those emails you had quarantined. You can export the list of delivered and denied emails by clicking on the Export icon placed on top of the list.

delivered emails

If you wish to deliver any email under Denied Emails, you can do so by selecting that email and clicking the Deliverbutton placed above the list or the Deliver icon which appears when you hover over any user. To deliver multiple denied emails, select the emails and click on the Deliver button. To deliver all the denied emails, simply click on the Deliver All button. 

denied emails

Quarantine Exports

A list of all the quarantined emails that are scheduled to be exported can be viewed in the Admin Console. Here, you can view the Category (Quarantined/Delivered/Denied), the date on which the export was scheduled, the status of the export, the number of emails in the export and the name of the admin who scheduled the export. You can also download the exported emails from this section.

  1. Login to the Zoho Mail Admin Console.
  2. Go to the Security & Compliance menu and select Quarantine
  3. Select the Exports tab
  4. A list of all the scheduled exports can be viewed here. 
  5. You can click the Download icon next to the relevant export to download the ZIP file containing the relevant emails. 

All the exports will be available for download for 30 days from the day on which it was scheduled. You will not be able to download the exported emails after the 30 day period.

Share this post : FacebookTwitter

Still can't find what you're looking for?

Write to us: support@zohomail.com