Why Exchange Online Quarantines Legitimate Email (And How to Fix It)

Why does Exchange Online quarantine legitimate email?

Exchange Online quarantine exists to protect users from malware, phishing, and spam. It works well for that job. The tradeoff is that it sometimes catches legitimate mail too. When that happens, the affected user never sees the message and the sender may not know their mail was blocked.

A frequent and overlooked cause of quarantine false positives: the sending domain has no SPF record, no DKIM signature, or no DMARC policy, which makes Exchange Online treat the message as unauthenticated and therefore suspicious. The most common reasons quarantine catches legitimate mail:

• The message triggered the high-confidence spam filter
• The sender domain has no SPF, DKIM, or DMARC record, which makes the message look unauthenticated
• An attachment matched a DLP policy rule with quarantine as the action
• A transport rule redirected the message to quarantine
• The sender IP is on a blocklist that Defender checks against
• The message contains certain keywords or patterns that bulk mail filters flag

You cannot turn off quarantine entirely for malware and high-confidence phishing. Those protections are mandatory. But you can tune the thresholds that affect bulk mail, spam, and DLP matches.

How to find out what quarantined an email

Start with the quarantine digest. If the user has quarantine notifications enabled, they receive a daily digest of held messages with a release button next to each one. If the message is not in the digest, check the Security Portal directly:

1. Go to security.microsoft.com/quarantine
2. Set the time range to cover the expected delivery window
3. Search by sender address or subject line
4. Open the message to see the quarantine reason listed at the top

If the message is not visible in quarantine, try Message Trace in the Exchange admin center (exchange.microsoft.com/admin). Message Trace shows whether Exchange Online accepted, rejected, or delivered the message. If Message Trace shows delivered but the user never received it, check whether a rule moved it to a folder or whether a client-side filter redirected it.

For deeper diagnosis, look at the message headers. The X-Microsoft-Antispam header contains the SCL (Spam Confidence Level) rating. An SCL of 6 or higher usually triggers junk folder placement. An SCL of 9 typically triggers quarantine. The X-Forefront-Antispam-Report header shows which filter evaluated the message and whether any signature-based detections fired.

How to release a quarantined message

There are two ways to release mail from quarantine: user release and admin release.

User release works for individual messages. The user clicks the release button in their quarantine digest email or in the Security Portal quarantine view. This releases the message to the user inbox and optionally creates an allow entry for the sender for 30 days.

Admin release gives you more control. In the Security Portal, go to Quarantine, select the messages, and click "Release messages." As an admin you can also choose to add the sender or domain to the Allowed Domains list in anti-spam policy settings, which reduces the chance of future false positives from that source.

For bulk operations, use PowerShell with the Release-QuarantineMessage cmdlet. This is useful when you need to release a pattern of messages across many users at once, for example after fixing a DLP rule that was too broad.

How to prevent legitimate mail from being quarantined

Preventing false positives is easier than releasing them one by one. Here is what works in order of effort.

1. Check sender authentication records first

Legitimate mail from unauthenticated domains is a common false positive trigger. If a sender domain has no SPF record, no DKIM signature, and no DMARC policy, Defender has less confidence the mail is genuine. Ask your regular senders to publish SPF and DKIM records for their sending infrastructure.

When your own outbound mail is being quarantined by recipients, that is a separate inbound problem for those recipients. DMARC alignment failures are a frequent cause. DMARCFlow monitors your inbound DMARC reports and flags authentication failures that indicate your domain is being impersonated or that your own sending is misconfigured. Either issue can contribute to delivery problems at the quarantine level.

2. Tune anti-spam policy thresholds

In the Security Portal, go to Email > Anti-spam settings. The default spam threshold is 7 out of 9 on the SCL scale. Lowering the threshold to 5 or 4 makes the filter less aggressive but increases the chance some spam reaches the inbox. Adjust this based on your organization's tolerance.

You can also configure the allowed domains list here. Add domains you trust that are regularly flagged, such as partner domains or internal relay servers. This prevents their mail from being quarantined as external spam.

3. Review DLP policies with quarantine actions

Data Loss Prevention policies can move messages to quarantine instead of blocking them outright. In the Security Portal, go to Data > DLP policies. For each policy with quarantine actions, check whether the rules are too broad. DLP rules that match on partial credit card numbers or common internal project names will catch legitimate internal mail and quarantine it.

4. Use connector-based filtering exceptions

If you have a third-party email gateway or on-premises relay that routes mail through Exchange Online, make sure the inbound connector is marked as trusted. Unscoped connectors that accept mail from any IP are more likely to have that mail quarantined.

5. Configure quarantine policies to control what gets held

Quarantine policies determine what happens when a message matches a rule. In anti-spam and anti-phishing policies, you can select which quarantine policy applies. Policies with "no notification" enabled mean users do not receive a digest and cannot self-release. Policies with "user release" enabled give users the ability to release without admin involvement.

How to monitor for quarantine patterns

If quarantine events keep happening, monitoring helps you find the root cause before users report it.

Set up a quarantine summary notification for admins. In the Security Portal, go to Email > Quarantine > Quarantine policies and configure an admin notification address. This sends a daily summary of all quarantined messages across the organization.

Use Message Trace regularly to spot spikes. A sudden increase in quarantine events often means a DLP rule changed, a sender started a new campaign, or a blocklist entry was added.

Authentication failure monitoring catches a specific category of quarantine problem. When SPF, DKIM, or DMARC authentication fails for inbound mail, the receiving system may quarantine that mail rather than deliver it. DMARC report monitoring aggregates these authentication results and shows you exactly which sending domains are failing and why. This matters because authentication failures often indicate a misconfiguration that can be fixed at the source, rather than a content problem that requires exception handling.

DMARCFlow automates this monitoring. It parses your inbound DMARC reports, flags domains with high failure rates, and tells you whether the failures are alignment failures, SPF hard fails, or DKIM signature validation errors. This is the fastest way to identify which sender domains need to fix their authentication setup before their mail ends up in quarantine at your end or at other destinations.

Summary

Exchange Online quarantine is a safety net that sometimes catches legitimate mail. The main causes are authentication gaps, aggressive DLP rules, and high spam thresholds. To fix it: check the quarantine reason in the Security Portal, release the message, then tune the policy that caused the hold. To prevent it: add SPF and DKIM records for trusted senders, review DLP rules with quarantine actions, and add trusted domains to the allowed list.

Monitoring authentication failures with DMARC reports helps you catch the root causes before they become quarantine problems. Check your inbound DMARC reports regularly, especially for domains that send you high volumes of legitimate mail.