Email Quarantine

The Email Quarantine feature lets analysts review emails that were blocked by the Spectra Detect SMTP Connector and, when appropriate, release them so they are delivered to their original recipients.

When Spectra Detect runs the SMTP Connector in in-line relay mode, it holds back emails that meet its blocking criteria instead of delivering them. Spectra Detect then uploads each blocked email to a Spectra Analyze appliance that acts as the quarantine, where it's stored as an .eml sample. From Spectra Analyze, an analyst can inspect the email and its analysis results, and then release it if it's safe.

The original recipients don't receive a blocked email unless it's released. Senders aren't notified. Recipients may get a notification if Spectra Detect is configured to send one. For the blocking criteria and notification settings, see the SMTP Connector documentation.

note

Availability: Email Quarantine requires Spectra Analyze 9.8 or later and Spectra Detect 6.1 or later.

Releasing emails from quarantine must be enabled on the Spectra Analyze appliance by ReversingLabs Support.

Requirements

Spectra Analyze receives and analyzes quarantined emails without any setup. As soon as the Spectra Detect SMTP Connector is configured with the appliance's address and token, blocked emails appear on the appliance as .eml samples, with a comment that explains why they were quarantined. You can use this to check the Spectra Detect side before release is enabled.

Email Quarantine is designed for a Spectra Analyze appliance that's used exclusively as the quarantine for the Spectra Detect SMTP Connector.

To release emails from quarantine, the Spectra Analyze appliance needs:

• The Email Quarantine feature, enabled by ReversingLabs Support.
• SMTP enabled and configured in Administration > Configuration > SMTP. Released emails are sent through this mail server. Until SMTP is configured, Release From Quarantine is unavailable.

Set the SMTP server to a mail server that delivers to your users directly, such as your downstream MTA. Don't point it at the Spectra Detect SMTP Connector: a released email sent there would be analyzed again, and quarantined again.

Identifying quarantined emails

Quarantined emails are .eml samples acquired through the Spectra Detect SMTP Connector. Each quarantined sample carries an automatically added comment explaining why it was quarantined:

Comment	Reason
Sample quarantined because of classification.	The email's classification isn't one of the allowed classifications set on Spectra Detect.
Sample quarantined because it contains prohibited network reference(s).	A URL, domain, or IP address in the email failed the network reputation check on Spectra Detect. The comment doesn't say which reference it was. Spectra Detect scores network references with its own risk tolerance setting, so the references in the sample's Network References section may not be classified as malicious in Spectra Analyze.
Sample quarantined because it was sent from a blocked IP address.	The sender's IP address is on the blocklist.
Sample quarantined because it was sent from a blocked domain.	The sender's domain is on the blocklist.
Sample quarantined because it was sent by a blocked sender.	The sender's email address is on the blocklist.
Sample quarantined because it contains a blocked URL.	The email contains a URL that's on the blocklist.
Sample quarantined because it contains an attachment with a blocked hash.	The email or one of its attachments has a hash that's on the blocklist.
Sample quarantined because it couldn't be scanned.	Spectra Detect analyzed the email but returned no result.
Sample quarantined because it couldn't be processed.	Spectra Detect couldn't analyze the email, even after retrying for several days.

Emails quarantined because of a blocklist entry, or because they couldn't be scanned or processed, may not have been analyzed by Spectra Detect. Spectra Analyze analyzes every quarantined sample when it's uploaded.

The quarantined sample isn't byte-for-byte identical to the original email: Spectra Detect adds analysis headers to it, such as X-Reversinglabs-Classification. As a result, its hashes differ from the hashes of the original email.

The comment is visible in the Comments section of the Sample Details Summary page and in the Expanded Details on the Search & Submissions page.

Releasing an email from quarantine

You can release a quarantined email from either of the following places:

• On the Sample Details Summary page of the .eml sample, open the actions menu and select Release From Quarantine.
• On the Search & Submissions page, open the actions menu (☰) for the .eml sample and select Release From Quarantine.

Any signed-in user can release an email; the action isn't limited to administrators. The email is released as soon as you select the option, without a confirmation step, so check the email before you select it.

Release From Quarantine appears on every email sample, but it only works for emails that the Spectra Detect SMTP Connector quarantined. For any other email sample, the release fails with a message that the sample isn't a quarantined sample.

When an email is released:

• Spectra Analyze hands the email to the mail server configured in its SMTP settings, which delivers it to the original recipients.

• An automatically generated comment is added to the sample, recording the user who released it and the time of release (in UTC), for example:

  Released from quarantine by nonadmin on 2026-03-17 09:58:38 UTC. (auto-generated message)

• The sample stays on the appliance. Releasing an email doesn't delete it.

An email can be released only once. If the mail server doesn't accept the email, Spectra Analyze shows an error, doesn't add the comment, and the email stays in quarantine, so you can try again. Once the mail server accepts the email, Spectra Analyze doesn't track whether it reaches the recipients.

A released email doesn't pass through Spectra Detect again, so it's delivered even though it was originally blocked. Release an email only after you've confirmed it's safe.

If a quarantined sample is deleted from the appliance, it can no longer be released.

Finding quarantined and released emails

Quarantined emails are uploaded to Spectra Analyze under the user account whose token is set as the Quarantine Token on Spectra Detect. To list them, use the submission-user keyword in Advanced Search with that account's username, for example submission-user:quarantine. Add classification: or other keywords to narrow the results.

To check whether a specific email has already been released, look for the Released from quarantine by… comment on the sample.

Notifications

Spectra Analyze has no alert type specifically for quarantined emails. Because the quarantine appliance receives only quarantined emails, an alert subscription to Analysis Alerts at the Static Analysis Finished stage notifies you about each new quarantined email.

Cross-product workflow

Email quarantine is a joint Spectra Detect and Spectra Analyze workflow:

1. Spectra Detect (configured in the Spectra Detect Manager): The SMTP Connector runs in in-line relay mode and is configured with the address and access token of the Spectra Analyze appliance that acts as the quarantine. Blocked emails are uploaded there as .eml samples.
2. Spectra Analyze: ReversingLabs Support enables the Email Quarantine feature, and an administrator configures SMTP for delivering released emails.
3. Day-to-day use (analyst): The analyst reviews quarantined emails in Spectra Analyze and selects Release From Quarantine for emails determined to be safe. The email is delivered to its original recipients, and the release is recorded in the sample's comments.