Managing the blocked message queue

Administrator Help | Forcepoint Email Security | Version 8.5.x

The page Main > Message Management > Blocked Messages lists all blocked messages from most queues across all appliances together in a single table, with a column entry that indicates the name of the queue in which a message is stored. Messages in the archive and Delayed Messages queues are not included on this page.

View messages by date/time range

Use the View from/to fields to specify the desired date/time range for viewing entries. The calendar includes the following options:

Change the month and year by using the back and next arrows around the month and year at the top of the calendar.

Set the calendar to the current date by clicking the date in the lower left corner of the calendar.

Click Clean to clear the current date/time calendar selection.

Click Today to set the calendar date to today's date.

Set the time range in hours and minutes in the entry fields to the right of the calendar.

Click the arrow to the right of the View date/time range to display the desired queue items.

Search messages by keyword

Use the Search functionality to perform a keyword search of blocked messages, and to refine a search by message IDs, senders, recipients, subjects, or policies applied. You can also search on an individual queue or on the name of the appliance that processed the messages (Processed By category). The Search functionality includes the following options:

In the text field, enter a keyword.

From the pull-down menu, click a category on which to search; ID, Subject, Sender, Recipient, Policy/Rule, Processed By, or All.

Click Search.

The messages matching the search parameters display.

Configure the number of messages to display

Use the Per Page menu to configure how many messages to view on each page of the queue.

From the pull-down menu per page, select the number of messages to display on each page; 25, 50, or 100.

The default is 25.

The following table details the information displayed in the list of blocked messages.

Parameter

Description

Sender

Sender email address.

Recipient

Recipient email address.

Subject

Message subject.

Click the link to display the View Message page for viewing message information and contents. See Viewing a message in a queue.

Size

Message size.

Date/Time

Date and time of message receipt.

Policy/Rule

Policy and rule applied to the message. If a data loss prevention (DLP) policy is applied to a message, this information displays as a clickable link.

Click View Incident to open the DLP incident information in the Data module, where the message was processed.

This column does not display in the archive queue.

Queue

Queue in which the message is stored (for example, spam, virus, exception, encryption-fail, or decryption-fail).

Message Type

Type of message (for example, spam, virus, exception, commercial bulk, advanced malware detection - cloud, advanced malware detection - on-premises, spoofed email, URL analysis, encryption error, or decryption error).

Processed By

Name of the appliance that processed the message.

Quarantined Reason

Indicates why a message was sent to a quarantine queue:

Antivirus filter

Email hybrid service

URL analysis filter

Bounce address tag validation

Digital fingerprinting antispam tool

LexiRules antispam tool

Heuristics antispam tool

Commercial bulk email filter

Custom content filter

Block List (Personal Email Manager Always Block List entry)

Archive feature (a setting on the page Settings > Inbound/Outbound > Message Control)

Data loss prevention

Exception (message exception)

For a message attachment analyzed by Forcepoint Advanced Malware Detection for Email - Cloud, click View report(s) to open a pop-up box with links to an Advanced Malware Detection - Cloud report on each file examined.

Select a message in the blocked messages queue and perform the following actions:


Action	Description
Deliver	Deliver the message to its recipient(s).
Delete	Delete the message from the queue.
Reprocess	Delete the message from the queue and restart the email processing function as if the email system were receiving it for the first time.
Not Spam	Report that the message should not be classified as spam and release the message for delivery. This option is available only when spam messages are selected.
Refresh	Refresh the queue contents list to view up-to-date queue contents.

The pull-down menu More Actions includes the following operations:


Action	Description
Resume Processing	A message that has both spam and virus characteristics may be isolated by one type of filter before it has been processed by the other type. If the original quarantine is a false positive, use this action to make sure the message is processed by all relevant filters rather than delivered after only the first analysis.
Add to Always Block List	Add the message sender to the Always Block List.
Add to Always Permit List	Add the message sender to the Always Permit List.
Forward	Forward the message to one or more recipients. The forwarded message is added as an attachment to the forwarding message.
Download	Download the message in .eml format. Downloaded email is saved in a zip file.
Reprocess all messages	Reprocess the messages in your search result. Only the first 5000 entries in your search result are reprocessed.
Delete all messages	Delete the messages in your search result. Only the first 5000 entries in your search result are deleted.