---
title: Quarantine watch
description: The daily and weekly routine, what to look at and when to raise a flag.
icon: Eye
verified: 2026-08-18
---

For the people who watch the Quarantine folder. It takes about two minutes a day.

Suspicious mail: very high spam score, or an executable or macro attachment, no
longer reaches user inboxes. It is parked in a single
[Quarantine folder](/docs/it/email/quarantine-folder) instead. Nothing is deleted
automatically during the observation phase, and that is the point: the job is to
watch that folder and say when something looks wrong, so the rules can be tuned
before any of them starts deleting.

## Daily: about 2 minutes

Pick a fixed moment, right after lunch for example. Every day until 21 August 2026;
twice a week after that.

1. Open the [Quarantine folder](/docs/it/email/quarantine-folder).
2. Read the senders and subjects, and ask **one** question:
   *is there any message here that a real person is waiting for?*

If it is all spam and malware, you are done for today. If one message looks
legitimate: a real customer, supplier or colleague, **do not delete or move
anything.** Send the alert below.

### What a false positive looks like

- A sender the company actually works with. Check the spelling closely: spammers
  register look-alike domains such as `kasikornbank-secure.com` in place of
  `kasikornbank.com`.
- A subject that belongs to a conversation already in progress: an order number,
  a real project name.

When unsure, alert anyway. A false alarm costs two minutes; a lost customer email
costs considerably more.

<Callout type="info">
  The daily `tradefinance@kasikornbank.com` messages to `chanhom@` are genuine KBank
  correspondence, verified 2026-08-17. If one ever appears in Quarantine, that is a
  false positive worth reporting.
</Callout>

## Weekly: about 5 minutes

Pick a fixed slot on a busy weekday. Monday at 14:00 works, and the reason it has
to be a busy day is that [Track Delivery](/docs/it/email/track-delivery) only
covers the previous 24 hours.

1. Open Track Delivery.
2. Click **Show Blocked & Failed**.
3. Report anything on the [watch list](/docs/it/email/track-delivery#what-to-report).

## The alert

One message per incident, to Bastien, by email or chat.

```text
ALERT, advmfr.net quarantine
Date/time seen: …
Folder or screen: Quarantine / Track Delivery
Sender: …
Recipient: …
Subject: …
Why it looks legitimate (or suspicious): …
Screenshot attached: yes/no
```

## Never

- Do not delete or empty the Quarantine folder during the observation phase.
- Do not edit, delete or reorder anything in
  [Global Email Filters](/docs/it/email/global-email-filters).
- Do not add whitelist entries yourself, send the request.
- Do not enable **BoxTrapper** on any mailbox. It replies automatically to forged
  sender addresses, which damages the server's reputation.
- Do not release a quarantined attachment to a user without confirmation.
- Do not send bulk mail from any `@advmfr.net` mailbox: the whole domain shares
  180 outgoing messages per hour, and mail above that limit is destroyed.

## Junk is not Quarantine

Every mailbox has its own Spam/Junk folder, filled by the o2switch antispam. That
is a different thing from the central Quarantine, and a user can safely drag a
message out of their own Junk. Three things to know before doing it:

1. **It teaches the filter nothing.** The o2switch antispam does not learn from
   "Not Junk". If the same sender keeps landing there, that is a whitelist request.
2. **It applies only to that user's own Junk.** Nothing ever leaves Quarantine
   this way.
3. **Check the look-alike domain first** if the message carries an attachment or a
   payment request. When unsure, ask before clicking.

## Calendar

| Period | Task |
|---|---|
| Until 21 Aug 2026 | Daily 2-minute Quarantine check |
| After 21 Aug, if seven clean days | Score-10 rule switches to silent deletion; checks drop to twice a week |
| Quarterly | Quarantine and Spam folders purged, rules reviewed |

If someone reports a missing email at any time: Quarantine first, then
[Track Delivery](/docs/it/email/track-delivery) with the **full** address, then the
alert above.