Outgoing Quarantine
An outgoing quarantine holds the outgoing mail of one mailbox or send-only account for review. While it's on, the server accepts every message the address sends and puts it on hold: nothing reaches the recipients, and nothing bounces back to the sender.
The quarantine is a response to a stolen password: an attacker who knows it can send spam from the mailbox, and that can put the server on block lists for your mail and other accounts' mail. A quarantine stops the mail at once; if it was a mistake, the cost is a delay, and the held mail is still there.
A refusal is final: if the panel refused a user's mail by mistake, their real mail would bounce. Held mail can go out later, so the panel can act fast and without a person.
Who starts a quarantine
| Started by | When |
|---|---|
| The server operator | They see abuse from the address. |
| You | You think somebody else is sending mail from the address. |
| An automatic rule | The address's activity in the last hour looks like abuse. |
The automatic rules
The panel checks an address's activity as it arrives, so a rule acts within seconds. Each rule looks at the address's last hour:
| Rule | Holds the mail when, in one hour |
|---|---|
| Login spread | The address signs in to send mail from 20 or more networks it never used before, or from 3 or more countries it had no sign-in from in the last 180 days. |
| Rate-limit pressure | The address's rate limit refuses 30 or more messages. |
| Forged senders | The server refuses 10 or more of the address's messages because they're sent as an address it can't send email for. |
| Remote rejection | Receiving servers reject much of the address's mail as spam, by policy or for unknown recipients, and much more of it than of the server's other mail. |
These are the defaults. The server operator can change them, turn a rule off, or make a rule only notify the operator; on many servers the remote-rejection rule only notifies. The operator can also exempt an address from the automatic rules, e.g. a newsletter address that sends a lot of mail. A manual quarantine still works on such an address.
A rule counts only activity after the end of the address's last quarantine, so the activity that started one quarantine can't start the next one at once. New activity of the same kind can.
To start one yourself, open the address in Email, open the Quarantine tab, and select Hold the Outgoing Mail. Mail the address already queued is held too.
What you see
When a quarantine starts, the panel tells:
- You, in your system mailbox, with a link to the quarantine page. You aren't told about a quarantine you started yourself.
- The email user, in their mailbox. The message says their outgoing mail is held and that they must contact you or the operator, and nothing an attacker could use. A send-only account has no mailbox, so it gets no message.
While the quarantine is on, the email user also sees it in two more places:
- The sign-in portal. Its home page and Security & Sign-In page show the alert Your outgoing email is held for review. The alert opens a page that says since when the address's outgoing mail is held and how many messages are waiting, tells the user to contact you or the operator, and links to the pages where they can secure the account again: change the password, the active sessions, the app passwords, and the account activity, which shows the start of the quarantine.
- Webmail. Webmail tells the user their outgoing mail is held, and a held message in the Sent folder shows that it's held for review.
If you chose Show your contact details for the Can't sign in? page, this page and webmail show the same contact details.
All these notices show the same facts only: the mail is held, since when, how many messages are waiting, and whom to contact. They don't show why the quarantine started, the rule or its figures, or who started it, because the reader could be the attacker. The email user can't release the held mail or end the quarantine.
In the panel, the address shows a Quarantined badge in the list of accounts and a banner on each of its pages, and has two tabs for the quarantine:
| Tab | What it shows |
|---|---|
| Quarantine | Whether the outgoing mail is held. When it is, the tab shows why and since when, and the actions that end the quarantine; if a rule started it, the figures that made the rule act. It also shows the history: each quarantine of the address, who started it, when it ended, and how many held messages were released and deleted. |
| Outgoing Queue | The address's outgoing mail queue. Held messages show the state On hold, and this is where you release or delete the ones you select. The number on the tab is the number of held messages. |
Review the Held Mail on the Quarantine tab opens the Outgoing Queue tab filtered to the messages on hold.
The panel reads the mail queue every few minutes, so a message the server just held can take a few minutes to appear on the Outgoing Queue tab.
The user's mail clients see no error: the server accepts each message, so the client shows it as sent. Only the notices, the sign-in portal, webmail, and the panel reveal the quarantine.
How long held mail stays
The panel deletes a held message four days after it arrived in the queue. One day before the first deletion, it sends a reminder to your system mailbox, once per quarantine.
A message released after five days in the queue isn't delivered; the mail server returns it to the sender. A message the operator releases after four days still has one day to go out.
The quarantine itself doesn't end when the mail expires. It stays on until a person ends it, and holds each new message meanwhile.
Release or delete held messages
On the Outgoing Queue tab, you can release or delete the held messages you select. Neither action ends the quarantine.
- Select the messages. The checkbox in the table header selects all the messages on the page.
- Select Release or Delete.
Each action changes only the messages you selected on the current page; messages on other pages don't change. A released message goes to its recipients; a deleted one can't be recovered.
Each action is recorded, with the number of messages, in the mailbox's Auth Log, or in the Account Auth Log for a send-only account. The history on the Quarantine tab counts each quarantine's messages: the ones you released or deleted, the ones the end of the quarantine released or deleted, and the ones the panel deleted after four days.
What you can do depends on who started the quarantine.
| Started by | Release | Delete |
|---|---|---|
| You | Yes | Yes |
| The server operator, or a rule | No. Only the server operator can release this mail. | Yes |
End a quarantine
The actions that end a quarantine are on the Quarantine tab. Again, what you can do depends on who started it.
| Started by | What you can do |
|---|---|
| You | Release All and End or Delete All and End. You can also lock the mailbox down. |
| The server operator, or a rule | Lock Down and End, or ask the operator to review the held mail. |
Why a lockdown
If the operator or a rule started the quarantine, the mailbox's password may be in an attacker's hands. If the quarantine ended with the password unchanged, the attacker would keep sending spam. So the only way for you to end such a quarantine is Lock Down and End: the lockdown of the mailbox, with three measures you can't turn off:
- the password is removed, and the user sets new credentials with a setup link
- the old password goes on a list that stops its reuse
- the mailbox's queued mail, including the held mail, is deleted
The other lockdown measures stay your choice. The quarantine ends once the lockdown completes; if the lockdown fails, the quarantine stays.
The lockdown deletes the held mail. If the user needs a message, they send it again after the lockdown, or you ask the server operator to release it before you lock the mailbox down. You can delete held messages before the lockdown, e.g. the spam.
A send-only account
A send-only account has no password of its own; it signs in with app passwords only. So Lock Down and End on a send-only account:
- removes every app password of the account and creates one new one, shown once. Put it in the programs that send mail as this address.
- deletes the account's queued mail, including the held mail
The old app passwords stop at once. App passwords are random characters, so the new one can't match an old one, and no list of old app passwords is needed.
The end of a quarantine changes no password and unlocks nothing. If the same activity starts again, a rule can quarantine the address again.