Outgoing Mail Quarantine
A quarantine holds the outgoing mail of one mailbox or send-only user. While it is on, the mail system accepts every message the address sends and puts it on hold: nothing reaches a recipient, nothing bounces, and the sender's mail client sees a normal "queued" reply. The held mail can be released later, so the server can act on a suspicion within seconds and leave the decision to a person.
The quarantine exists for the stolen password: an attacker who has one sends spam from the mailbox until the server's addresses are on block lists, which costs every account on the server. What the account holder and the domain user see is in the account docs.
Who starts one
| Started by | How |
|---|---|
| An automatic rule | The address's last hour looks like abuse (below). |
| You | Hold the Outgoing Mail of an Address on the quarantine screen, the address's Quarantine tab, or host:account:quarantine. |
| The account holder | The Quarantine tab of the address in the account panel. |
A start also holds the mail the address already queued, as far as the queue snapshot and the last five minutes of submissions know it. If the mail system refused to hold that mail, the screen says so: the quarantine is on, but the mail already queued can still go out.
The automatic rules
The server evaluates an address when a signal about it arrives: a sign-in to send mail, a refusal by the rate limit or the sender check, a bounce or a deferral of its mail. Each rule looks at the address's last hour, and at nothing before the end of its last quarantine, so the activity that started one quarantine can't start the next by itself. An address already quarantined, or exempt, is skipped. Every signal needs the address's own credentials, so no other account can trigger a rule against it.
| Rule | Fires when, in one hour | Default thresholds | Default mode |
|---|---|---|---|
| Login spread | The address signs in to send mail from many networks it never used before (/24 for IPv4, /64 for IPv6), or from several countries it had no sign-in from in the last 180 days. | 20 new networks, or 3 new countries | Enforce |
| Rate-limit pressure | The address's submission rate limit refuses many messages. | 30 refused messages | Enforce |
| Forged senders | The server refuses many of the address's messages because they are sent as an address it can't send email for. | 10 refused messages | Enforce |
| Remote rejection | Receiving servers reject much of the address's mail as spam, by policy or for unknown recipients, and much more of it than of the rest of the server's mail. | 20 rejected recipients, 30 % of the address's recipients, 3 times the share of the rest of the server | Observe |
Each rule has a mode:
| Mode | Effect |
|---|---|
| Off | The rule isn't evaluated. |
| Observe: tell the operators only | A hit is written to the auth log and mailed to you (System mail), once per address, rule and hour. Nothing is held. |
| Enforce: hold the outgoing mail | A hit starts a quarantine. |
An IP block at a large receiver hits every sender on that address, so a high rejection rate alone would quarantine innocent accounts after somebody else's spam run. The rule compares the address with the rest of the server for that reason, and it still ships in Observe: tune its thresholds on a few weeks of your server's notices before it holds anything.
The screen
System › Outgoing Mail Quarantine has four parts: Held for Review, every open quarantine with its address, account, start and who or which rule started it; Hold the Outgoing Mail of an Address, a manual start with an optional reason the account holder sees; Settings; and Ended, the history with how each quarantine's held mail was settled.
An address has two tabs:
| Tab | What it holds |
|---|---|
| Quarantine | Whether the mail is held, since when, who started it, the rule and its evidence (the figures that made it fire), the reason, when held mail is deleted, and the actions that end the quarantine: Release All and End and Delete All and End. Below them, Automatic Quarantine exempts the address from the rules or ends the exemption, and History lists every quarantine of the address. |
| Outgoing Queue | The address's Outgoing Mail Queue, with the number of held messages on the tab. Select the messages the quarantine holds and Release or Delete them; the quarantine stays on. Review the Held Mail on the first tab opens this one narrowed to the mail on hold. |
A held message the quarantine doesn't hold, because you held it by hand or it was released a moment ago, is listed and can't be selected.
Settings
| Setting | Default | What it does |
|---|---|---|
| Most held messages per address | 1,000 | When a quarantined address has this many messages on hold, the mail system answers its client with a temporary refusal (450 4.7.1) instead of holding more, so a botnet can't fill the spool through an address with a high rate limit. |
| Keep held mail for | P4D (four days) | An ISO 8601 duration from one to five days. The panel deletes a held message this long after it arrived in the queue, and tells the account holder a day before the first deletion. |
| Automatic quarantine rules | As in the table above | Each rule's mode and thresholds. |
The mail system doesn't expire a message on hold, but its clock runs: a message released after five days in the queue is returned to the sender at once. Four days leaves a released message a day of delivery attempts.
These settings are only on this screen; server:edit and the server API
don't set them yet. The exemption of an address is only on its
Quarantine tab.
What you can do, and what the account holder can
An admin user may end any quarantine and release or delete any held message. The account holder's rights depend on who started it:
| Started by | Account holder may |
|---|---|
| The account holder | Release or delete held mail; end the quarantine; lock the mailbox down. |
| A rule, or you | Delete held mail, and end the quarantine only with Lock Down and End, which resets the password and deletes the queued mail. |
Release All and End and Delete All and End take the hold off and nothing else. If the password is in an attacker's hands, the same activity quarantines the address again. When the quarantine was a true positive, lock the mailbox down as well, or ask the account holder to.
A quarantine never ends by itself. When its held mail has been deleted after the retention period, the quarantine stays on and holds each new message, until a person ends it.
Who is told
| Who | When | How |
|---|---|---|
| The account holder | At the start, and a day before held mail is deleted | Their system mailbox and a banner in the account panel. Not for a quarantine they started. |
| The domain user | At the start | A message in their mailbox, then an alert in the sign-in portal and in webmail: the mail is held, since when, how many messages wait, whom to contact. Never the rule, the evidence or who started it, because the reader may be the attacker. |
| You | A rule-started quarantine, and each hit in Observe mode | The auth log, and a plain-text notice into the server's own root mailbox, forwarded to the --admin-email addresses (System mail). |
Every start, end, release and delete is a row in the mailbox's auth log, or the account's for a send-only user (Auth Log).
On the command line
elpanctl host:account:quarantine <user@hostname> --reason="<why>"
elpanctl host:account:quarantine:end <user@hostname> --release
elpanctl host:account:quarantine:end <user@hostname> --delete
elpanctl host:account:quarantine:list
elpanctl host:account:quarantine:list --all --format=jsonl
The address can also be the mailbox's UUID. host:account:quarantine:end
is the screen's Release All and End or Delete All and End;
host:account:quarantine:list shows the open quarantines with their
counts of released and deleted mail, and --all adds the ended ones.
Releasing or deleting a selection, the exemption and the settings have no
command.