Viewing message details

Click a message subject to view details for that message.

This page explains why a quarantined message was blocked or if a message was classified as commercial bulk email and includes the message headers, message text, and details of any attachments. If the message has been analyzed by the File Sandbox and found to be suspicious, the page includes a link to the File Sandbox report. From this page you can perform the actions described in Performing actions on the results.

To download the quarantined message, click Download Message. (Administrators must have the View Quarantine policy permission to download quarantined messages.)


	Important Quarantined messages may contain malicious content. Exercise caution when downloading and viewing message contents.

If you want to release or forward a message from this page, clicking Release or Forward to sends the message for any further processing before delivery. If you want to bypass any other processing rules that you have set up and deliver the message directly to its recipient, check the No further processing box before releasing or forwarding. We recommend that you review the message carefully before doing this.

For quarantined messages, you can also choose to allowlist or blocklist the sender's email address or domain. When you do this, the item in blocklist or allowlist becomes a per-user antispam policy within the email policy that applies to the intended message recipient. For more information, see Antispam exceptions.

Viewing logs

Click View log to see full details of the message processing and results. The log appears at the bottom of the message details page.

For a quarantined message, the log details provide the exact reasons for the quarantine. For example:

For messages quarantined due to a virus, the log lists the virus name.

For blocked attachments, the log includes the file type or class that matched against the attachment.

For blocked images, the log includes a thumbnail of the image. See Managing quarantined images.

For lexical rule failures, the log lists the phrase that triggered the quarantine.

For spoofed messages, the log details the outcome of the spoofing detection checks used to validate the message. The log entry may include the following items:

DMARC: pass or fail, based on DKIM and SPF checks

DKIM: checks the digital signature of the sender's domain

SPF: checks the SPF record for the envelope sender address

SPF_HELO: checks the SPF record for the SMTP HELO name

SPF_P2: checks the SPF record for the content sender ("from") address.

If email is classified as commercial bulk email, the message details page may also contain log lines indicating the action taken:

Commercial bulk message subject tag added for <recipient>.

Commercial bulk message quarantined for <recipient>.

Commercial bulk message detected and allowed due to policy settings for <recipient>.


	Note You cannot view logs for discarded messages.

Managing quarantined images


	Note You must have the Email Security Image Analysis Module to use this feature.

If a message has been quarantined due to an inappropriate image attachment, a thumbnail of the image appears under Blocked Images at the end of the message log details. Note that you must have the "View Quarantine Images" permission to access these images.

If you consider a quarantined image to be acceptable, you can add it to the image allowlist by clicking Add to allow list under the thumbnail. If the image is already in the allowlist and you wish to remove it, click Remove from allow list.


	Note We recommend that you only add images to the allowlist that are likely to cause the repeated quarantining of messages.

The image allowlist can contain a maximum of 200 images; if you have already reached this limit, the Add to allow list option is greyed out.

For more information on the image allowlist, see Image allowlist.