User Guide for Quarantine and Digest

Retarus Email Security assures reliable, productive and safe email communication, free of spam, viruses and phishing scams.

Malicious or unwanted emails are not delivered, but stored in the Retarus email quarantine. You will receive a digest (“Email Security Report”) containing a list of all new messages that were retained in the quarantine. Emails containing a virus are deleted immediately, but are listed for information.

Via a web-based user quarantine, you can view and retrieve quarantined messages online. You may also manage your own allow- and blocklist here.

Email security report (digest)

The Email Security Report, short “digest”, listing all quarantined emails will be delivered in regular intervals according to your settings. If no malicious or unwanted emails have been blocked for you since the last report, you will not receive a digest.

In the upper right corner, the digest contains a link to your online quarantine, where you get more information about your blocked emails, may release them, and manage your AntiSpam Blocklist and Allowlist. The link also contains authorization information for accessing the online quarantine, so that you don’t have to enter username or password. For security reasons, the link is only valid for two days. If you’d like to access your online quarantine afterwards, you have to request a new digest including an updated link (see Ad-hoc digest).

The digest may contain up to three sections (tables). The first section displays all messages that were quarantined due to specific rules defined by your company. The second table contains all messages classified as spam. The third section lists all threats (malware/virus infected or phishing emails). If there is no message that corresponds to one of these categories, the respective list will not be displayed in the digest.

Quarantined due to filter rules

Messages withheld by your organization’s filtering rules are listed in the first table in the digest. These include, for example, emails filtered because of entries on a blocklist, the maximum allowed message size, failed authentication or messages that contain attachment types that your organization prohibits for security reasons. The quarantine reasons (classifications) are explained in the glossary at https://www.retarus.com/glossary.

Messages listed in this section may be released using the Retrieve link in the right column of the digest. You will receive the original email in your inbox within a short period of time.

Quarantined due to spam suspicion

All incoming emails are checked for spam and given a spam probability score. Any message with a spam probability above a certain threshold value (default is 60% spam probability, but this can be adjusted by your administrator) is stored in your user quarantine and listed in this digest section. By default, the messages are sorted by spam probability in ascending order. Emails with the lowest spam probability will be at the top of the table.

Messages listed in this section may be released using the Retrieve link in the right column of the digest. You will receive the original email in your inbox within a short period of time.

Quarantined as threat

For security reasons, all dangerous/malicious messages are listed separately in this section: virus-infected emails, phishing emails or emails being classified as fraud attempt.

Virus-infected emails are rejected or deleted automatically; they are listed, but not stored, so they cannot be released. Phishing emails or emails classified as fraud attempt may be released by default, but this should be done with great care and only after checking the details in your online quarantine.

In doubt, please ask your administrator or help desk before releasing an email contained in this section!

Ad-hoc digest

You can demand an “ad-hoc” digest at any time without having to wait for the regular digest. This can be required to get a new valid login link to your online quarantine, but also if you are returning from a longer absence or vacation and do not want to go through all daily digests, but receive a report that spans your complete absence period.

In order to receive the latest digest, simply click on the link for the desired time span located at the end of an existing digest. You will then receive a new one listing all messages received in the last 2 or 30 days. Alternatively, the digest can also be requested directly via email. Simply send an email to digest@qstore.retarus.com with the subject digest30 (where “30” may be replaced by the number of days that you’d like to aggregate). You’ll receive a new digest in your inbox within a short period of time.

Email quarantine

Regardless of the digest message interval, the online quarantine allows you to view and, if required, release all intercepted messages for a given period of time (30 days by default).

The only case where messages cannot be released is if they have been rejected or deleted, for example, because they contained a virus.

The user quarantine can be accessed by clicking on the Show messages in online quarantine portal button in your email digest. In order to get access, you should always use the latest digest as the access link is only valid for two days. If you do not have a current digest, you may request it by sending an email to digest@qstore.retarus.com with the subject digest30 (where “30” may be replaced by the number of days that you’d like to aggregate).

When you access the quarantine, you will see all quarantined emails, sorted by date (latest on top).

If you access the quarantine from a mobile device, a slightly different (mobile-optimized) view is used.

You may search for an email by sender or subject by using the search bar on top. When you click on More options, additional search criteria is made available: date range, classification (quarantine reason), attachments included or not, as well as spam probability.

When you put your mouse over an entry, several icons appear on the right side: You may directly release the email, download it as *.eml file for further analysis or add the sender to your personal AntiSpam Allowlist or Blocklist. (The option of adding a sender address to the allowlist/blocklist is only visible if your administrator has configured the right to maintain a personal block- and allowlist for you.)

By clicking on a quarantined email, you get to see some details. A click on the Advanced button shows even more details like the Envelope-From address. On the details page as well, you may release or download the email and add the sender to your personal Allowlist/Blocklist.

Allowlist & Blocklist

You may access and manage your personal AntiSpam Allow- and Blocklist directly from the online quarantine (if your administrator has configured the right to maintain personal lists for you).

Your administrator also has access to these lists, so that he may prevent erroneous blocking of addresses and users from accidentally unblocking senders that should remain blocked.

Allowlist

This option is only visible if you are allowed to maintain a personal allow-/blocklist.

The allowlist contains senders (email addresses or domains) whose emails are delivered independently from the calculated spam probability.

To delete an entry, use the recycle bin button on the right side of the corresponding line.

To add an entry, just click on the icon to the right. You can either add single email addresses or entire domains. Domains may be put on the list without a leading @ symbol.

You may also add multiple entries at the same time, e.g. to import a complete list of entries from a text file (like it can be exported from Outlook). In order to add multiple entries at once, click on the icon to the right. You can either add single email addresses or entire domains. Domains may be put on the list without a leading @ symbol.

If an entry is contained in the allowlist as well as in the blocklist, the allowlist entry “wins”, so emails from this sender are delivered.

Blocklist

The blocklist contains sender email addresses from which all messages are quarantined and not delivered to the recipient.
Entries may be added to the list or deleted in the same way as it works for the allowlist (see Allowlist).

If an entry is contained in the allowlist as well as in the blocklist, the allowlist entry “wins”, so emails from this sender are delivered.

User settings

A click on the green button in the upper right corner (with the initials of the user name) shows the user's email address, which is especially useful if you manage multiple user quarantines. You can also use it to log out or to adjust your settings for the digest.

Independent of the digest settings, quarantined emails are retained in quarantine for a certain period of time before they are deleted automatically. By default, this expiry time is set to 30 days.