--- title: "Review quarantined mail" description: "Find quarantined threads in the MachineMail dashboard, read the trust report, compare agent-safe and raw views, then release it or block the sender's domain." canonical: "https://machinemail.dev/docs/guides/review-quarantine" --- # Review quarantined mail > Find quarantined threads in the MachineMail dashboard, read the trust report, compare agent-safe and raw views, then release it or block the sender's domain. Source: https://machinemail.dev/docs/guides/review-quarantine MachineMail quarantines a message when its trust report finds it dangerous: it looks like phishing, carries instructions aimed at an AI agent, or carries a virus. A quarantined thread gets the `QUARANTINE` label instead of `INBOX`. Agents do not see it unless they ask for quarantined mail on purpose. Mail from a sender on a block list is handled differently. It gets the `BLOCKED` label instead, and agents don't see it either. A person decides what happens next. This guide shows how to do that in the dashboard. To handle quarantine in code, see [Using trust in agents](https://machinemail.dev/docs/trust/using-trust-in-agents#handle-quarantine-with-a-human). ## Find quarantined threads Open [machinemail.dev/app/threads?label=QUARANTINE](https://machinemail.dev/app/threads?label=QUARANTINE). Or go to **Threads**, open the **Label** filter and choose **QUARANTINE**. Add the **Inbox** filter to look at one inbox. Quarantined threads do not appear in an inbox's own list or in the unfiltered Threads list. The label filter is how you find them. ## Open the thread Select a thread. A red **Quarantined** banner sits at the top: "Agents don't see this thread unless they list with include\_quarantine. Review the trust report before releasing it." You can't reply to a quarantined thread. The reply box says **Release the thread before replying**. ## Read the trust report Each message has a **Trust report** bar at the bottom, with the number of reasons. Click it to open the report. You can also right-click the message and choose **View trust report**. On a phone, use the **⋯** menu on the message. The report has these parts: | Part | What it tells you | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------- | | **Verdict** | The score (higher is safer) and the level: Verified, Known, Unknown, Suspicious or Quarantined. | | **Authentication** | SPF, DKIM and DMARC results, and whether they line up with the From address. | | **Sender** | How often this inbox has written to and heard from the sender, and flags such as **On block list** or **Free mail provider**. | | **Content scrub** | What MachineMail removed before agents saw the text: hidden text, zero-width characters, tracking pixels. | | **Classifier** | How likely the message is to contain instructions to an agent, phishing, a request for credentials or payment, or spam. | | **Reasons** | The plain reasons behind the verdict. Start here. | | **Links** | Each link, with warnings such as a visible text that names a different domain than the real destination. | | **Attachments** | Each attachment with its risk and reasons. | [The trust report](https://machinemail.dev/docs/trust/trust-report) explains every field. ## Compare Agent-safe and Raw The switch at the top right of the thread has two views: - **Agent-safe** shows the text an agent would read. Pieces MachineMail removed appear as chips under the text, for example **Hidden text removed** with its length. - **Raw** shows the original text, with hidden text highlighted in red, and the message's headers. Hidden text that tells an agent what to do is the usual reason for a quarantine. Raw shows you exactly where it was. Right-click a message to copy the **Agent-safe text** or the **Raw text**, or to **Download raw .eml**. ## Release or block Use the buttons on the **Quarantined** banner: * **Release** moves the thread back to the inbox. It shows up in message lists again, and you can reply. The trust report itself does not change: the level stays Quarantined, and the MCP tools keep withholding the content. * **Block** followed by the sender's domain (for example **Block example.com**) adds the domain to your organization's receive block list. Type `DELETE` and confirm. From then on, mail from that domain to any inbox is labelled `BLOCKED` and withheld from agents, until you remove the rule on [Lists](https://machinemail.dev/app/lists). Blocking does not release or delete the thread in front of you. To remove it too, right-click it in the thread list and choose **Move to trash** or **Delete thread**. If you do nothing, the thread stays quarantined and agents keep ignoring it. When mail from a sender you rely on keeps landing here, releasing each thread is the wrong tool. Open **Trusted domains** in the sidebar and add the sender's domain, or one exact address: mail it genuinely signs is then never quarantined, and you can release what was held in the last 30 days in the same step. Mail held for malware, phishing or instructions aimed at agents stays held. See [Trusted domains](https://machinemail.dev/docs/concepts/trusted-domains). Release only when the report and the raw view both make sense to you. A released thread shows up again for every agent that lists the inbox. ## Other things you can do Right-click any thread in a list for more actions: - **Release from quarantine** does the same as **Release** on the banner. - **Quarantine** moves a thread that got through into quarantine, so agents stop seeing it. - **Block** followed by the domain blocks the sender's domain from the list. For a sender on your own domain, or one with no domain, the item reads **Block sender domain** and is greyed out. > **Not in the dashboard:** The dashboard shows and edits only organization-wide allow and block rules. Pod and inbox lists are set with the API or the CLI. The quarantine threshold is fixed and can't be changed. ## Troubleshooting | Symptom | Fix | | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | A quarantined thread is not in the inbox | That is expected. Use the **QUARANTINE** label filter on **Threads**. | | The reply box is greyed out | The thread is quarantined. Release it first. | | The same sender is quarantined again and again | Add it on **Trusted domains**. Its signed mail is then judged as trusted. | | **Block sender domain** is greyed out | The sender is on your own domain, or has no domain. Add a rule on **Lists** instead. | | Mail from a blocked domain still arrives | It is labelled `BLOCKED` and withheld from agents. Find it with the **BLOCKED** label filter. Remove the rule on **Lists** to undo it. | ## Related - [Trust layer](https://machinemail.dev/docs/trust) - [Trust report](https://machinemail.dev/docs/trust/trust-report) - [Using trust in agents](https://machinemail.dev/docs/trust/using-trust-in-agents) - [Trusted domains](https://machinemail.dev/docs/concepts/trusted-domains) - [Lists and suppressions](https://machinemail.dev/docs/concepts/lists-and-suppressions)