Review quarantined messages, and deliver to recipients or prevent delivery
The Google Workspace Moderation Tool email quarantine feature lets admins send incoming and outgoing email messages to a quarantine, where they’re held for review before delivery to recipients. Learn more about setting up an email quarantine.
In the email quarantine dashboard, you can get detailed information about quarantined messages and then take decide what action to take on them:
- Release the message from quarantine so it’s delivered to the recipient.
- Prevent the message from being delivered to the recipient.
Open email quarantine
Important: When you log into email quarantine, your admin privileges determine which quarantines and quarantined messages you can see. Learn more in Give your users access to email quarantine.
You can open email quarantine in one of these ways:
Navigate to the quarantine dashboard in your Admin console
-
Sign in to your GoogleAdminconsole.
See AlsoShould Viruses Be Deleted or Quarantined?QuarantineManage quarantined messages and files as an admin - Microsoft Defender for Office 365QuarantineSign in using an account with super administrator privileges(does not end in @gmail.com).
- From the Admin console, go to Apps > Google Workspace > Gmail > Manage quarantines
- Click Go to Quarantine.
Enter the quarantine dashboard URL in your browser
In your web browser, when logged into your Google Workspace account, go to http://admin.google.com/ac/moderation. From here, you have access to all quarantines associated with your admin role and the group you’re a member of.
Review quarantined messages
When you log into email quarantine, the default view is all messages in all quarantines with a status of of Pending triage.
To get details about which quarantine a message belongs to, point at the message in the dashboard. The Quarantine details box opens, and it shows the quarantine name and the settings that you created for the quarantine.
The quarantine dashboard includes these columns:
| Column | Description |
|---|---|
| Name | Recipient's email address |
| Direction | Email message direction:
|
| no heading | Quarantine name. This column includes all quarantines that include the message. Different settings can send messages to more than one quarantine. Click a quarantine name to see, and optionally edit, the settings for thequarantine:
|
| no heading | Message subject |
| no heading | First part of message contents |
| Time | Time the message was sent. The time is displayed in the Admin console’s local time zone. |
Filter quarantined messages
Using the controls at the top of the dashboard, you can filter messages by quarantine or by message status.
Important: When you filter by message status, only messages allowed by the quarantine admin privileges are displayed. Learn more in Give users access to email quarantine.
- To show messages from one quarantine, click Quarantine, select a quarantine from the list, and click Apply.
- To show all messages from all quarantines, click Quarantine, select All, and click Apply.
- To filter messages by quarantine status, click Status, select a status, and click Apply.
| Status | Description |
|---|---|
| Pending triage | Displays messages that haven’t been Denied or Allowed. If no action is taken on these messages, they’re deleted after the retention period for quarantined messages. |
| Denied | Displays messages that have been denied delivery. Only messages sent to quarantinewithin the retention period are displayed. |
| Allowed | Displays messages that have been released for delivery to recipients. Only messages sent to quarantine within the retention period are displayed. |
Search for quarantined messages
To find messages by searching on message content, at the top of the dashboard, enter search terms in the Search field. Only messages that match the current dashboard filters (Quarantine name and message status) are searched.
All message content is searched, including header information such as sender address, recipient email address, message subject and message body.
To create more targeted searches, use the same search operators used in Gmail.
| Field | Description |
|---|---|
| Rule description | Name or description of the setting that quarantined the message. The field appears one or more times. This field appears for each rule that quarantined the message. |
| Quarantine name | The name of the quarantine for the message. This field appears for each quarantine the message appears in. Messages can appear in more than one quarantine. |
| Source | The part of the message that matched the setting that quarantined the message. For example, message header or body content matched a string you entered in the setting that quarantined the message. Sometimes this information isn’t available and this field isn’t displayed. |
| Matched string | The word or string in the message that matched the setting that quarantined the message. Sometimes this information isn’t available and this field isn’t displayed. |
View email message headers
Headers are short code snippets that are sent along with an email message and contain information about the message. Some headers, such as From: and Subject:, are typically visible in a message. Other headers are only visible when you view full headers for the message. To view the complete content of a quarantined email message, including all email headers:
- In the quarantine dashboard, clickthemenu
to the left of the Name column. The dashboard entry expands to show the message. - At the bottom right of the expanded entry, click Show Original.
to the left of the Name column. The dashboard entry expands to show the message.Learn more about email message headers.
Take action on quarantined messages
When you allow or deny delivery of a quarantined message, you can’t undo the action.
Allow delivery of quarantined messages
To allow delivery of a quarantined message, select one or more messages by clicking the checkbox in the left column, then click Allow at the top of the dashboard.
The message is delivered to the recipient. If the recipient can’t find the message, have them check their Spam folder.
Deny delivery of quarantined messages
To deny delivery of a quarantined message, select one or more messages by clicking the checkbox in the left column, then click Deny at the top of the dashboard.When you deny delivery, depending on the Denial consequence option you selected in the quarantine's settings, a default rejection notice might be sent to the sender.
Denied messages stay in the quarantine until they’re permanently deleted, 30 days after they were sent. After 30 days, these messages aren’t available in quarantine, and can't be recovered by admins or users
If you use additional storage, for example Google Vault, messages are available in that storage until the defined expiration period for that storage.
Deny delivery of a message that's in more than one quarantine
Messages can be sent to multiple quarantines. The result of a deny action is based on settings of the quarantine that's selected when you deny message delivery.
For example, a message might appear in a quarantine called Suspicious, which has a denial consequence of Drop message, and also in a quarantine called Large attachment, which has a denial consequence of Send rejection notice. If you deny delivery of the message instance from theSuspicious quarantine,the message is dropped but no rejection notice is sent.
Related topics
Set up email quarantine
Give your users access to email quarantine
Was this helpful?
How can we improve it?
