LinkedIn
Twitter
Email Log Search will tell you exactly which compliance rule caused the message to be quarantined, like in this example:
Mail will only be sent to an admin quarantine if you have a compliance rule set that was matched.
Email Log Search absolutely identifies which compliance rule was triggered, as you can see in my screenshot below (under Quarantine - Matched rules).
Even Business Starter edition supports Gmail compliance rules so all Google Workspace editions should behave the same in this regard.
If you're having challenges managing admin quarantines and Gmail compliance rules, I recommend reaching out to your Google Cloud Partner for assistance.
This is what I see, the email log search in the first image:
And this is what's displayed in the quarantine:
What am I missing?
Here's a wider view... look under recipient details not post-delivery message status:
Was this an email received from internal or external?
I usually only see this on the sender of internal emails (appears in Email Log Search as a separate recipient) but on the actual recipient (expand that section instead) it will display the rule matched as in my screenshot.
Here's an example (email sent from tim to christian😞
Emails sent from an external source that are quarantined will show only recipients, with the quarantine rule matched, like this:
Thanks for the blog post link, that's really helpful! We're in the midst of actualy migrating from Google to o365, but I do need to work on our DMARC policy.
The only Gmail safety setting I have set to quarantine is this:
And I have a content compliance rule in place to quarantine, but it's only on matches of 2 specific strings, and I'm fairly confident that rule isn't being tripped in any of the messages I see in quarantine. I have seen the rule tripped before, and it does display properly in the quarantine "matched rules" when it happens, which is exceedingly rare.
Basically, I've got everything extremely loose as far as I'm aware, (not ideal obviously) to no avail here.
The reason for this is that the default rule has a null description. The functionality that it appears to be providing (explanation of why it was quarantined), is not what it is under the hood. It's just telling you what default or custom rule specified here put it in the quarantine.
I ran into this as well. Best bet is to just parse the headers and review for any issues, then escalate to google support if all looks clear.
As noted in another response - if you go to Gmail>Safety>Spoofing and Authentication there are a a few options there that can be turned on or off, some with additional settings - including what quarantine to place it in. What I have done is create a separate quarantine for each of these, with their names so I know what triggered it to be quarantined. You can then see them individually or all at once. I still haven't found any method to modify these at all to never quarantine some items based on my needs.
