---
title: "Suspended mail"
description: "Why Outpost holds a message instead of ticketing it, how long it keeps it, and how to release, allow, block, or discard it."
url: "https://support.outpostplatform.com/service-desk/suspended-mail/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "Settings > Suspended mail lists mail a support mailbox received but did not ticket. Held reasons (release in one click): sender not verified, automatic reply, too many messages, blocked sender. Quarantined reasons (release asks first): spam, failed sender authentication, too large, could not be read. Kept 7 or 30 days. Actions: Release, Allow sender, Block sender, Block domain, Discard."
availability:
  plans: ["enterprise", "msp"]
  permission: "mailbox:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/service-desk/suspended-mail.md"
license: "CC BY 4.0"
---

# Suspended mail

Suspended mail is mail a support mailbox received but did not turn into a
ticket. Outpost holds it so someone can look before it is lost: spam, mail
that fails sender authentication, automatic replies, and floods from one
sender. This page lists why mail is held, how long it is kept, and what you
can do with it. For how email becomes tickets, see
[Email to ticket](/service-desk/mailboxes/).

Suspended mail is under **Settings** > **Suspended mail**, beside
**Mailboxes**. You need `mailbox:manage` to see it, because held messages can
carry anything a stranger sent.

## Reasons and how long mail is kept

Each message has a reason and a class. **Held** mail is released in one
click. **Quarantined** mail may be unsafe, so Outpost asks you to confirm
before it releases it. Messages are deleted automatically on the date in the
**Deleted on** column.

| Reason | Class | Why it is held | Kept for |
| --- | --- | --- | --- |
| **Sender not verified** | Held | The sender could not be verified, and the mailbox is set to **Hold in Suspended mail for review**. See [Sender verification](/service-desk/mailboxes/#sender-verification). | 30 days |
| **Automatic reply** | Held | An out-of-office reply, bounce, or other automatic message that does not reply to a ticket. | 7 days |
| **Too many messages** | Held | One sender opened 20 new tickets in the last hour. | 30 days |
| **Blocked sender** | Held | The sender or their domain is blocked. | 7 days |
| **Marked as spam** | Quarantined | A spam filter in front of the mailbox flagged it. | 30 days |
| **Failed sender authentication** | Quarantined | The message fails DMARC for its From domain, and the sender is not allowed. | 30 days |
| **Too large** | Quarantined | The message is larger than 35 MB. | 30 days |
| **Could not be read** | Quarantined | The message is malformed and could not be parsed. | 30 days |

Mail loops and floods from automated systems are stopped automatically and
never become tickets. They do not appear here.

When a mailbox has 50 or more held messages, Outpost raises an information
alert, **Held mail for** the mailbox's address **is waiting for review**. It
clears when the count drops below 25.

## Find a message

Search covers the sender and the subject, never the message body. Filter by
**Mailbox**, **Reason**, or **Class**. Select a sender to open the message.

The message shows the From, To, Cc, subject, mailbox, and when it arrived.
**Sender checks** shows the DMARC, SPF, and DKIM results and whether the
sender domain is aligned. **Text preview** shows the text of the message only,
never its HTML, because a held message may be hostile. Attachments are listed
by name and size. **Download the original (.eml)** downloads the message as it
arrived.

## Act on a message

| Action | What it does |
| --- | --- |
| **Release** | Turns the message into a ticket, or adds it to the ticket it replies to. Quarantined mail asks you to confirm first. A released message counts as verified, so the ticket sends email as usual. |
| **Allow sender** | Releases the message, as **Release** does, and allows the sender's address, so their future mail goes straight to tickets. |
| **Block sender** | Blocks the sender's address and discards the message. Their future mail is held as **Blocked sender**. |
| **Block domain** | Blocks everyone at the sender's domain and discards the message. |
| **Discard** | Deletes the message. It cannot be released later. |

Block, block domain, and discard always ask you to confirm.

A released message runs through the remaining checks. If it fails a different
one, it is held again under the new reason. A released **Too large** message
becomes a ticket without the attachments over 25 MB.

Allow and block apply to the mailbox the message arrived on. An allowed
sender is ticketed as verified even when their mail fails DMARC, so allow
only senders you trust. A block wins over an allow.

## Release a message

1. Go to **Settings** > **Suspended mail**.
2. Select the sender to open the message.
3. Check **Sender checks** and **Text preview**.
4. Select **Release**, or **Allow sender** to release it and allow the sender.
5. For quarantined mail, select **Release** or **Release and allow** to
   confirm.

The page shows **Released. It is ticket** and the ticket number, as a link to
the ticket.

## Related

- [Email to ticket](/service-desk/mailboxes/)
- [Troubleshoot a support mailbox](/service-desk/mailbox-health/)
- [Alerts](/service-desk/alerts/)