Manage quarantined messages

Review quarantined messages, and deliver to recipients or prevent delivery

The Google Workspace Moderation Tool email quarantine feature lets admins send incoming and outgoing email messages to a quarantine, where they’re held for review before delivery to recipients. Learn more about setting up an email quarantine.

In the email quarantine dashboard, you can get detailed information about quarantined messages and then take decide what action to take on them:

  • Release the message from quarantine so it’s delivered to the recipient.
  • Prevent the message from being delivered to the recipient.

Open email quarantine

Important:  When you log into email quarantine, your admin privileges determine which quarantines and quarantined messages you can see. Learn more in Give your users access to email quarantine.

You can open email quarantine in one of these ways:

Navigate to the quarantine dashboard in your Admin console

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. From the Admin console, go to Apps > Google Workspace > Gmail > Manage quarantines
  3. Click Go to Quarantine.

Enter the quarantine dashboard URL in your browser

In your web browser, when logged into your Google Workspace account, go to http://admin.google.com/ac/moderation. From here, you have access to all quarantines associated with your admin role and the group you’re a member of.

Review quarantined messages

When you log into email quarantine, the default view is all messages in all quarantines with a status of of Pending triage.

To get details about which quarantine a message belongs to, point at the message in the dashboard. The Quarantine details box opens, and it shows the quarantine name and the settings that you created for the quarantine.

The quarantine dashboard includes these columns:

Column Description
Name Recipient's email address
Direction

Email message direction:

  • Inbound: Incoming message. If an inbound message has multiple recipients, the message appears the quarantine once for each recipient. For example, a message with five recipients appears in the quarantine five times.
  • Outbound: Outgoing message. Outbound messages that you allow to be delivered are quarantined only once before delivery.
no heading

Quarantine name. This column includes all quarantines that include the message. Different settings can send messages to more than one quarantine. Click a quarantine name to see, and optionally edit, the settings for the quarantine:

  • Description
  • Inbound message denial action
  • Outbound message denial action
  • Notification setting
no heading Message subject
no heading First part of message contents
Time Time the message was sent. The time is displayed in the Admin console’s local time zone.

Filter quarantined messages

Using the controls at the top of the dashboard, you can filter messages by quarantine or by message status. 

Important: When you filter by message status, only messages allowed by the quarantine admin privileges are displayed. Learn more in Give users access to email quarantine.

  • To show messages from one quarantine, click Quarantine, select a quarantine from the list, and click Apply.
  • To show all messages from all quarantines, click Quarantine, select All, and click Apply.
  • To filter messages by quarantine status, click Status, select a status, and click Apply.
Status Description
Pending triage Displays messages that haven’t been Denied or Allowed. If no action is taken on these messages, they’re deleted after the retention period for quarantined messages.
Denied Displays messages that have been denied delivery. Only messages sent to quarantine within the retention period are displayed.
Allowed Displays messages that have been released for delivery to recipients. Only messages sent to quarantine within the retention period are displayed.

Search for quarantined messages

To find messages by searching on message content, at the top of the dashboard, enter search terms in the Search field. Only messages that match the current dashboard filters (Quarantine name and message status) are searched.

All message content is searched, including header information such as sender address, recipient email address, message subject and message body.

To create more targeted searches, use the same search operators used in Gmail.

Field Description
Rule description Name or description of the setting that quarantined the message. The field appears one or more times. This field appears for each rule that quarantined the message.
Quarantine name The name of the quarantine for the message. This field appears for each quarantine the message appears in. Messages can appear in more than one quarantine.
Source The part of the message that matched the setting that quarantined the message. For example, message header or body content matched a string you entered in the setting that quarantined the message. Sometimes this information isn’t available and this field isn’t displayed.
Matched string The word or string in the message that matched the setting that quarantined the message. Sometimes this information isn’t available and this field isn’t displayed.

View email message headers

Headers are short code snippets that are sent along with an email message and contain information about the message. Some headers, such as From: and Subject:, are typically visible in a message. Other headers are only visible when you view full headers for the message. To view the complete content of a quarantined email message, including all email headers:
  • In the quarantine dashboard, click the menu  to the left of the Name column. The dashboard entry expands to show the message.
  • At the bottom right of the expanded entry, click Show Original.

Learn more about email message headers.

Take action on quarantined messages

When you allow or deny delivery of a quarantined message, you can’t undo the action.

Allow delivery of quarantined messages

To allow delivery of a quarantined message, select one or more messages by clicking the checkbox in the left column, then click Allow at the top of the dashboard.

The message is delivered to the recipient. If the recipient can’t find the message, have them check their Spam folder.

Deny delivery of quarantined messages

To deny delivery of a quarantined message, select one or more messages by clicking the checkbox in the left column, then click Deny at the top of the dashboard. When you deny delivery, depending on the Denial consequence option you selected in the quarantine's settings, a default rejection notice might be sent to the sender. 

Denied messages stay in the quarantine until they’re permanently deleted, 30 days after they were sent. After 30 days, these messages aren’t available in quarantine, and can't be recovered by admins or users

If you use additional storage, for example Google Vault, messages are available in that storage until the defined expiration period for that storage. 

Deny delivery of a message that's in more than one quarantine

Messages can be sent to multiple quarantines. The result of a deny action is based on settings of the quarantine that's selected when you deny message delivery.

For example, a message might appear in a quarantine called Suspicious, which has a denial consequence of Drop message, and also in a quarantine called Large attachment, which has a denial consequence of Send rejection notice. If you deny delivery of the message instance from the Suspicious quarantine, the message is dropped but no rejection notice is sent.

Related topics

Set up email quarantine

Give your users access to email quarantine

Moderate Chat and Gmail messages

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu