What is email quarantine, why does a suspicious email end up in quarantine?
Email quarantine is the holding of an email deemed suspicious in a separate area before it reaches the inbox: the email is not deleted; an authorised person reviews it and, if necessary, releases it. In this guide, we explain how quarantine works, why an email ends up in quarantine, and which signals and rationale SmartMail uses to make the quarantine decision.
What is the difference between quarantine and the spam folder?
The spam folder in most email programs is a junk area that users check on their own. Quarantine, by contrast, is an organizational security layer. The differences between them:
- Decisions are justified. It is recorded why an email was quarantined; you can see which signal had how much impact.
- Permission is separate. Who can review and restore an email in quarantine is determined by a permission. Not every employee is expected to move a suspicious email to the inbox with one click.
- A decision becomes organizational memory. Releasing an address from quarantine or explicitly blocking it is a decision that also applies to future emails.
The purpose of quarantine is not to destroy the email but to stop it before it reaches the employee.
Why does an email go into quarantine?
The quarantine decision is based not on a single signal but on a combination of several measurements. Main reasons:
The sender identity cannot be verified. If the server the email came from is not in the SPF record of the sender domain; if the DKIM signature is broken or missing; if the domain's DMARC policy is not met, the email is considered suspicious. For the general meaning of these records our SPF, DKIM and DMARC guide you can view.
The address is spoofed. A domain that differs by one letter from your organization's domain, a display name that impersonates a brand, or your own organization's name in the display name while the address points elsewhere are strong signs.
The reply goes elsewhere. If an email comes from one address but the reply goes to a completely different address when you click "reply", this is especially common in payment fraud.
Links are misleading. If a link's visible text shows a bank's address while its actual destination leads to another site, or if your email address is embedded in the link, the email may be a phishing attempt.
The attachment is dangerous. Executable file types (such as .exe, .scr, .js, .iso) are almost never needed in business correspondence.
The content is suspicious. Pressure to act urgently, a request for a password or payment, unusual language… The AI assessment looks at the text as a whole.
Which emails are not quarantined?
A good quarantine protects emails it knows to avoid false alarms. In SmartMail, the following cases protect an email from quarantine even if the score threshold is exceeded:
- Internal company emails coming from your own domain,
- emails that continue a correspondence you have also written in,
- emails from addresses or organizations you have previously sent email to,
- senders from whom you regularly receive mail,
- business emails making a specific request of you,
- Emails from addresses that an employee previously removed from quarantine.
These protections prevent an email from your customer or supplier from disappearing one day for no reason.
What happens if quarantine makes a wrong decision?
No automated system is flawless; what matters is how a wrong decision is corrected. There are two types of error.
A legitimate email landing in quarantine. In this case, the biggest risk is the email waiting unnoticed. To prevent this, quarantine must be reviewed regularly and the release process must be easy. A released email returns to the inbox; more importantly, the next email from that address no longer lands in quarantine. The system remembers the decision made by a person.
A suspicious email reaching the inbox. No threshold can catch every attack. That is why quarantine is not the only defence but one of the layers. Emails that reach the inbox also carry a security badge; the user can see the email's score and reason from the badge next to the sender name. An employee who is suspicious can move the email to quarantine themselves if they have permission; if not, they draw the attention of the quarantine officer.
Both errors have different costs. A customer email being delayed by a day is annoying; applying a fake payment instruction is a loss that is hard to reverse. When setting the threshold, this balance must be established according to the organization's own risk appetite. A stricter approach in finance mailboxes that receive payment instructions, and a more flexible one in marketing and newsletter mailboxes, makes sense for most organizations.
How does quarantine work in SmartMail?
Every incoming email goes through three groups of checks. In the identity group, SPF, DKIM, DMARC and PTR records are recalculated by SmartMail. In the structure group, similar domain, brand and display name impersonation, reply address and link mismatches are measured. In the content group, the entire text is evaluated with AI, and a risk score between 0–100 and its rationale are produced.
The trust value derived from the risk score will not reach the inbox if it falls below the threshold set by the administrator; it will be quarantined. The threshold is adjusted from the administrator screen according to the organization's needs.
Some situations do not wait for a score: a sender explicitly blocked by the administrator, a server for which PTR verification cannot be performed, or an email whose reply-to address differs from the sender goes directly to quarantine. Only a written whitelist decision overrides this. Sender rules are defined at address or domain level; a decision about an address takes precedence over a decision about a domain. Every rule change is written to the audit log together with who changed it and when.
The permission to review and release a quarantined email is a separate permission granted per mailbox and is off by default on new assignment. When the email is released, it returns to the inbox; that address is also protected in subsequent emails.
The rationale for the quarantine decision sits alongside the email. When the badge is clicked, which signal contributed how many points is shown individually; so the employee is not only protected but also learns to recognise the next similar email themselves.
Security analysis of incoming emailReviewing a quarantined email
Points to consider when managing the quarantine
- Review quarantine regularly. A short weekly check prevents a genuine customer email from sitting on hold.
- Keep permissions limited. Give the quarantine management permission to one or two people who understand security.
- Read the reason when recalling. Read the reason before recalling the email; an SPF failure and a marketing email do not carry the same weight.
- When setting rules, prefer the address. Blocking the problematic address rather than the entire domain protects legitimate senders on the same domain.
- Change the threshold gradually, not all at once. Monitor the effect of the threshold change for a few days and then adjust it again.