Quarantine

Quarantine is where DeepFilter collects the emails it considers a threat but holds safely instead of rejecting outright. When an email's total threat score passes the quarantine threshold (roughly 12), DeepFilter does not deliver it to the recipient's inbox — but it does not discard it either. The reason is that no filter is perfect: an aggressive rule or a temporary configuration mistake can score a legitimate email as a threat by accident (a false positive). Quarantine is the safety net for that "suspicious band" between definitely clean and definitely malicious — an email caught by mistake can be recovered, while a genuine threat can be deleted for good.

Administrators use this screen in two situations: to find and deliver an email when a user reports that "an email I was expecting never arrived", and to review held threats regularly and teach recurring spam patterns to the system. Every email comes with a detailed threat score breakdown showing why it was held, so you can decide to release or delete based on evidence rather than guesswork.

The Pending view lists the emails that have not been acted on yet and are waiting for an administrator's decision.

Filtering the List and Reading the Scores

Status cards

The five cards at the top of the screen summarize the current state of the quarantine and double as clickable filters:

Card	What it shows
Quarantine	Number of emails currently held and not yet acted on
Released	Number of emails released for delivery to the recipient
Deleted	Number of emails permanently deleted
Learned Trusted	Number of emails taught as a "clean" sample
Learned Spam	Number of emails taught as a "spam" sample

Clicking a card narrows the list to emails in that state; clicking the same card again clears the filter and lists every state. The active card is highlighted with a border. This does the same job as the Status dropdown at the top right; the cards are simply a faster shortcut.

Status filter and search

The Status filter at the top right decides which emails are listed and defaults to Pending — that is, only emails awaiting action. The other options are Released, Deleted, Trusted, Spam and All. Per page sets how many records appear on a single page (50, 100, 250 or 500; the default is 50).

Text typed into the search box is matched against the sender, recipient and subject fields. When a user says "my email never arrived", the fastest route is to type their address into this box and search in the Pending view.

note

Per-row action buttons and bulk selection checkboxes exist only in the Pending view. In history views such as Released or Deleted, emails are read-only; those views add columns showing who performed the action and when instead.

The Score column: T and AI

The Score column on each row shows two separate values separated by "|", and the two say different things:

• T (total) — the combined threat score the email received from all rules; this value determines whether it is quarantined. The color changes with its size: below 8 green, 8 and above yellow, 40 and above orange, 100 and above red. The larger the value, the more likely the email is a threat.
• AI — the score produced by DeepFilter's artificial intelligence model, and its sign carries direction: a positive value means the model leans towards spam, a negative value means it leans towards trusted (ham). Below 0 is green (the model found it trustworthy), between 0 and 3 yellow, 3 and above red (the model called it spam). If the model produced no assessment, "—" is shown.

Reading the two scores together makes the decision easier: a high T with a negative AI points to an email that the rule-based layers saw as a threat but the artificial intelligence found trustworthy — worth opening the detail breakdown before releasing it.

Advanced filter

The Score, Country and Date buttons narrow the list quickly by a single criterion. Advanced filter applies several conditions together:

• Score range — the lowest and highest T score. Ready-made presets are available too: near the threshold (≤20), medium (20-60) and high (60+).
• Country — the country of the sending server.
• AI result — "AI Trusted (HAM)" (the model said ham) or "AI Not Evaluated".
• Category — the type of threat that triggered the email (artificial intelligence, blacklist, phishing, virus, authentication and so on).
• Match — decides whether all of the criteria you selected must be met, or any one of them.

Inspecting and Releasing an Email

Seeing an email's content and the reason it was held before you release it keeps you from delivering a genuine threat by mistake.

Steps

1. Open the Quarantine screen from the top menu and find the email in the Pending view (use the search box or the filters if needed).
2. Click the eye button at the end of the row (or the row itself) to open the detail window.
3. Alongside the sender, recipient, subject, source IP and country, the window shows the threat score breakdown: how many points each rule contributed to the score, and the sum of the positive and negative contributions. Clicking a rule row tells you what that rule is, why it triggered and which value it matched.
4. Once you have reviewed the content and the breakdown and concluded the email is safe, click Release in the window. If you prefer to release straight from the list, you can use the check button on the row instead; both paths ask for confirmation.

Verification — how to know it worked

• Releasing is not instantaneous; the email is placed in a processing queue. While it is being processed the row shows a Queued or Processing badge; once it completes, the Released card increases by one and the email moves to the Released view.
• If delivery notification to the recipient is enabled, the recipient receives a notice that the email has been released.

caution

Releasing cannot be undone: once an email has been delivered to the recipient's inbox it cannot be pulled back. If you are unsure about the content, preview it in the detail window first. Because the operation completes in the background, the Released counter may update with a delay of about 10 seconds; not seeing it change immediately is not an error.

Reading the bombardment signals

In the score breakdown you may come across three rule names that point to an email bombardment — hundreds of subscription and confirmation emails from different senders raining down on a single recipient in a short time. None of the three is a reason for quarantine on its own; they gain meaning together.

• Recipient Surge — reports that an unusual number of emails landed in this mailbox in a short time. It is a scoreless observation marker: it does not raise the score by itself, it only records the situation.
• Subscription Confirmation Pattern — means the body of the email carries a subscription or sign-up confirmation pattern; the pattern is recognized in more than fifteen languages. It is informational and produces almost no points. It is not a threat signal on its own — a legitimate newsletter confirmation gets this marker too.
• Subscription Bombing — indicates that the two markers above (or a recipient surge together with an unwanted verdict from the artificial intelligence) appear at the same time. This is the actual bombardment marker; even so, its score stays below the quarantine threshold, so it does not quarantine an email by itself.

If emails carrying these markers are piling up on a single recipient, that recipient is most likely under a bombardment shield: while the shield is up, the quarantine threshold is temporarily lowered for that mailbox alone, so the flood pours into quarantine instead of the inbox. You can see which recipient is under a shield and when the protection ends under Management → Inbound Mail → Features. Legitimate emails caught in the flood can be released from here as usual.

Deleting an Email

You delete an email to remove a genuinely harmful or unwanted message from quarantine.

Steps

1. Find the row in the Pending view.
2. Click the trash button on the row and confirm the prompt.

Verification — how to know it worked

• The email leaves the list, the Deleted card increases by one and the record appears in the Deleted view.

danger

Deleting is permanent and cannot be undone. No copy of a deleted email is kept; a legitimate email deleted by mistake cannot be recovered. If you are unsure, release the email or leave it in quarantine instead — emails that are never acted on are cleaned up automatically at the end of the retention period anyway.

Bulk Actions and Learning

In the Pending view you can process several emails at once and teach recurring spam patterns to the system. Ticking the checkboxes at the start of the rows (or the select-all checkbox in the header) opens a bulk action bar.

The actions on the bar:

• Release / Delete — applied to all selected emails in one pass; the result is identical to the individual actions.
• Learn Trusted — sends the selected emails to DeepFilter's Central Intelligence system as a "clean" sample and releases them at the same time (delivers them to the recipient).
• Learn Spam — sends the selected emails to Central Intelligence as a "spam" sample and deletes them at the same time.
• Download — downloads the selected emails as .eml files in a single archive. At most 20 emails can be downloaded at once. This button is available only to the global administrator role.

Learning happens only on this bar, which appears when you select more than one email; there is no learning action for a single row. Learning samples do not change the local model on this server instantly; they feed the central learning model and improve the whole system's discrimination over time.

Verification — how to know it worked

• While the operation runs, the page shows how many operations are in progress along with a queue breakdown; the counters refresh roughly every 10 seconds.
• When it completes, the relevant card (Released / Deleted / Learned Trusted / Learned Spam) increases.

caution

Learning does not just submit a sample, it also processes the email: Learn Trusted releases it (delivers it), Learn Spam deletes it. If you only want to classify an email and do not want the delivery or deletion that comes with it, do not use the learning buttons. Learning also sends the email's content to Central Intelligence as a sample; keep that in mind for emails carrying sensitive content.

Automatic Cleanup

Retention period — if an email in quarantine is neither released nor deleted within this period, it is cleaned up automatically and permanently. (default: 30 days; minimum 1 day)

Why it exists: quarantine cleans itself at regular intervals so it does not grow without limit with suspicious emails nobody reviews. That keeps the list manageable and stops old threats from accumulating.

If you change the value: shortening the period keeps quarantine tidier but narrows the window for recovering an email a user notices late. Extending it gives more time for recovery but crowds the list and stores held emails for longer.

You can change this period under Management → Inbound Mail → Quarantine.

caution

Automatic cleanup permanently deletes the email once the period expires — just like a manual delete, it cannot be undone. Keep the retention period long enough for users to notice and report a missing email.

Troubleshooting

I released an email but it never reached the recipient. Releasing is processed in the background, so it is not instant. Check the status badge on the row first: if it says Queued or Processing, the operation is still running — wait. If there is a Failed badge, hover over it to see the error description; failed operations are retried a few times at short intervals. You can inspect the delivery details (including the destination server's response) in the delivery section of the detail window.

The email I expected is not showing in quarantine. First make sure the Status filter is set to Pending; a different status may be leaving the email out of the filter. Then search by the recipient's address. If it cannot be found at all, the email may never have been quarantined (it was delivered directly or rejected); confirm what happened to it in the email traffic records.

The card numbers are not what I expected. If you signed in with a domain admin account, the cards count only emails for the domains you are authorized for. Learning operations also affect two counters at once: Learn Trusted raises both Learned Trusted and Released, while Learn Spam raises both Learned Spam and Deleted — because learning also delivers or deletes the email.