Accessing quarantined email

If users want to view the content of a particular quarantined message, they select the message (by clicking in the check box on the left), then click Details. They then have options of what to do with the message.

The details of a message may look something like this:

In this example a message was quarantined because it exceeded the maximum size specified in the policy. (The message is over 1 GB.) Note that the user can add the sender or sending domain to the antispam allowlist or blocklist. These lists bypass antispam processing; they do not bypass the policy’s message size restrictions. If the antispam allowlist and blocklist options are not enabled on the policy, the buttons do not display.

In some cases, users may be allowed to release a message or send a copy to themselves. If the email was quarantined because it contains a virus or offensive words, however, they would not be able to release a copy regardless of how the administrator has configured the service.

To view a list of quarantined messages, end users can sort on the Status column in their report, then scroll to the quarantined section.

When looking at the online version of their report, users can take action on all of the messages in their quarantine at once. To do so, they click Quarantined, then select an action to take from the drop-down list.

If, in the report, the user clicks a link to a message that was accepted, only the message log entries are shown, because the message is no longer available to Forcepoint Email Security Cloud.