---
title: Quarantine folder
description: Where suspicious mail is parked, one folder for the whole company.
icon: ShieldAlert
---

## Where

There is no menu entry for it. The path is:

<CpanelPath steps={['Email Accounts', 'System Account', 'sc6mixq8738', 'Check Email']} />

which opens Roundcube, where the folder sits at the top level:

<Files>
  <Folder name="sc6mixq8738 (system account)" defaultOpen>
    <Folder name="Quarantine" defaultOpen>
      <File name="everything the global filters catch" />
    </Folder>
    <File name="INBOX" />
  </Folder>
</Files>

That detour is not an accident. In a *global* filter, cPanel refuses
`Redirect to Email` toward any address the account controls, to prevent delivery
loops, so the quarantine cannot be a `quarantine@advmfr.net` mailbox. It is
instead a folder of the **system account**, which is the one place a global
filter is allowed to deliver to. The reasoning is in
[Strategy options](/docs/it/email/strategy-options).

## What it is

**One folder for all 87 mailboxes.** Everything the global filters catch lands
here, whatever the original recipient was. It started catching traffic on
2026-08-17.

Nothing is deleted from it automatically during the observation phase. That is
deliberate: a rule only graduates to permanent deletion after seven days with
zero false positives, and the evidence needed to judge that sits in this folder.

## Traps

**It is not a Junk folder.** Each mailbox also has its own Spam/Junk folder,
filled by the o2switch antispam: a separate layer, unchanged by any of this. A
user can safely drag a message out of their own Junk. Nobody drags anything out
of Quarantine.

**Clicking "Not Junk" teaches nothing.** In a user's own Junk folder that button
recovers the message and nothing more, the o2switch antispam does not learn from
it. If the same sender keeps landing in Junk, that is a whitelist request, not a
click to repeat.

## Never

- Do not delete or empty this folder during the observation phase.
- Do not release a quarantined attachment to a user without confirmation.
- Do not move messages out of it. Report instead.

## See also

- [Quarantine watch](/docs/it/email/quarantine-watch), the daily routine
- [Global Email Filters](/docs/it/email/global-email-filters), what puts mail here