What Is Email Quarantine and How Do You Release a Message?
The short answer
Email quarantine is a server-side holding area that catches suspicious messages before they reach the mailbox — unlike the junk folder, which sits inside the mailbox and syncs to your email client. Messages in quarantine are invisible to recipients until an admin or, in some configurations, the recipient explicitly releases them.
What email quarantine is, how it differs from the junk folder, who can release messages, and how long quarantined emails are held.
On this page
Email quarantine is a server-side holding area where a security filter parks messages it considers too risky to deliver — not to the inbox, and not to the junk folder, but to a separate, access-controlled store on the mail server that recipients cannot browse from their email client. Quarantined messages are effectively invisible to the recipient until an administrator, or in some configurations the end user, logs into a dedicated portal and chooses to release or delete them.
The distinction from the junk folder matters. Junk lives inside the mailbox: it syncs to Outlook, Apple Mail, and every other client, and recipients can open it anytime. Quarantine lives outside the mailbox, held at the server level, controlled by policy. One is a soft filter; the other is a hard hold. Enterprise mail platforms typically operate both in parallel — genuinely dangerous messages go to quarantine, lower-confidence bulk mail goes to junk.
How does email quarantine work?#
Enterprise mail security stacks run multiple filtering layers before a message reaches the inbox. When a message scores above a configured confidence threshold for phishing, malware, spoofing, or high-confidence spam, the platform diverts it to quarantine instead of delivering it. The recipient typically receives a quarantine notification — a digest email from the platform listing what was intercepted — and can follow a link in that digest to review and release messages the filter got wrong.
On Microsoft 365, quarantine is managed through the Microsoft Defender for Office 365 security portal, where admins have full visibility and end users can access their personal queue depending on the quarantine policy the admin configured. On Google Workspace, quarantine is managed in the Admin Console under Apps > Google Workspace > Gmail > Compliance; end users cannot release quarantined messages themselves in Google Workspace — that is admin-only as of mid-2026.
Retention windows vary by platform and message type. Microsoft 365 holds most quarantined messages for 30 days by default; high-confidence phishing messages are retained for only 15 days before automatic deletion. Google Workspace purges quarantined messages after 30 days. After the retention window, messages are permanently deleted without delivery — they are not bounced back to the sender.
How do you release a quarantined email?#
The release path depends on whether you are an end user or an administrator, and which platform holds the message.
- 1
Check the quarantine notification digest
Most platforms send a periodic digest email listing intercepted messages. Microsoft 365 sends one by default; Google Workspace requires the admin to configure end-user notifications. The digest typically includes the sender, subject, and a link to review the held message.
- 2
Log in to the quarantine portal
Microsoft 365 users follow the link in the notification to the Defender security portal. Google Workspace admins log in to the Admin Console. End users in Google Workspace cannot self-release — they must contact their admin.
- 3
Review the message in the portal
Open the message in the quarantine interface rather than releasing it blindly. Check the sender address, subject line, and preview. A legitimate message intercepted by mistake is usually obvious; a phishing attempt often reveals itself on inspection.
- 4
Release or delete
Release delivers the message to the recipient's inbox. On Microsoft 365, end users can self-release messages the admin's quarantine policy permits; admins can release any message. On Google Workspace, only an admin can release. Delete removes the message permanently.
- 5
Add the sender to the safe-senders list if appropriate
If the same legitimate sender is repeatedly quarantined, add them to the safe-senders list to prevent future interceptions. Do this selectively — adding a sender bypasses future filtering for that address.
Why does quarantine exist? What breaks without it?#
The junk folder exists for mail that is probably unwanted. Quarantine exists for mail that is probably dangerous. The operational difference is significant. A junk message sits in the mailbox, syncs to every device, and can be opened accidentally — which is a manageable inconvenience for misclassified newsletters but a real risk when the intercepted message contains a credential-harvesting link or a malware attachment.
Quarantine removes that risk by preventing the message from reaching any client until a human reviews it in a controlled environment. Without quarantine, security teams rely on user judgment at the moment of receiving a suspicious message — after it is already in the inbox and on every synced device. With quarantine, the filter intercepts before delivery, a reviewer checks it, and only then — if it is legitimate — does it reach the recipient.
False positives are the main operational cost. A missed invoice, a customer reply, or a job application may sit in quarantine unnoticed until the retention window expires. That is why quarantine notification digests exist, and why organizations with high false-positive rates often adjust filter confidence thresholds or maintain per-sender policies.
Quarantine vs junk folder: what is the difference?#
| Dimension | Email quarantine | Junk / spam folder |
|---|---|---|
| Location | Outside the mailbox, on the mail server | Inside the mailbox, syncs to every email client |
| Recipient visibility | Invisible to the recipient in their email client | Visible — recipient can open and read messages |
| Who can release | Admin, or end user only if the admin's policy permits (platform-dependent) | The recipient — they move it to the inbox directly |
| Delivery state | Not delivered; held before reaching any client | Delivered to the mailbox, filed in a subfolder |
| Retention | Fixed window (commonly 30 days) then auto-deleted | Kept until the user deletes or storage fills |
| Filter confidence | High — messages the platform is fairly certain are dangerous | Medium — likely unwanted but not necessarily malicious |
| Typical content | Phishing, malware, high-confidence spam, spoofed senders | Bulk marketing, newsletters, lower-confidence spam |
| Sync to email clients | Never — quarantine is portal-only | Yes — Outlook, Apple Mail, mobile clients all show it |
Common misconceptions about email quarantine#
Quarantine is the same as permanent deletion. It is not. Quarantine is a hold, not a deletion. Messages can be released and delivered to the inbox at any point during the retention window. They are permanently deleted only when that window expires or an admin explicitly removes them.
Any user can release any quarantined message. On Microsoft 365, the admin's quarantine policy controls what end users can self-release. High-confidence phishing is typically admin-release-only regardless of user preference. On Google Workspace, self-release is not available to end users; all releases require an admin.
Senders get a bounce when their message is quarantined. In most configurations, the sender receives no notification. From their perspective the message was sent and disappeared. Platforms avoid notifying senders intentionally — alerting a malicious actor that their attempt was intercepted gives them feedback to adapt.
Quarantine notification emails are always genuine. This is a real attack vector. Malicious actors send convincing quarantine digest lookalikes to trick recipients into entering credentials. If you are unsure a notification is genuine, navigate directly to your organization's quarantine portal rather than clicking a link in the email.
A longer retention window is always better. For security teams, a longer hold period extends the window for actionable false-positive complaints, but also increases the queue administrators must manage. Most organizations use the platform default of 30 days.
Fake quarantine notifications are a real phishing technique
How this shows up in AI Emaily#
Quarantine is a server-level mechanism that runs before mail reaches your inbox — it is not something an email client controls. But what lands in your inbox after quarantine filtering still contains lower-confidence suspicious messages that the server filter passed, and that is where a client-side layer matters. We build AI Emaily, an AI-native email client that applies a second layer of spam and phishing detection after messages are delivered, surfacing suspicious mail for your review before you engage with it. For cold outreach that is not a security risk but still clutters your inbox, AI Emaily's cold-email filter separates unsolicited pitches from conversations you actually want — without quarantining them.
AI Emaily connects to your existing Gmail or Outlook account and works alongside whatever server-side quarantine policy your provider applies. It does not replace or alter quarantine — it handles what gets through. You can learn more at aiemaily.com or start a 7-day free trial at aiemaily.com/pricing to see how the two layers work together on your real inbox.
Frequently asked
See it in AI Emaily
Keep reading
Sources
Written by
Nafiul HasanNafiul Hasan is an entrepreneur and AI automation system builder with 10+ years of experience turning messy, manual workflows into reliable automated systems. He designs and ships AI enterprise solutions end-to-end — the agent logic, the data plumbing, and the product people actually use — and founded AI Emaily to give busy professionals their attention back. He writes here from the builder's seat: what works, what breaks, and how to put AI to work without giving up control.