EnterraHost
The filter can mail a summary of what it held. That summary is the Email Scout Report, and it is the difference between noticing a held invoice the same morning and hearing about it from a supplier a week later. It arrives on a schedule, it lists what was stopped, and every entry in it links back to the message.
What the report contains
The subject line reads Quarantine Report for followed by the mailbox it covers and the time it was generated. That matters when one person receives several mailboxes, because the report names the address it belongs to rather than the domain.
Inside, the report names the domain, the name of the schedule that produced it and the number of entries. The table gives the sender and the subject of each held message, and the subjects are links. An unsubscribe link sits at the foot of the email, and it stops the report for that recipient without touching the filtering.
An empty report is the normal case on a quiet day. A report that arrives every morning with entries is telling you the filter is doing work, not that something is broken, and the useful signal is the count changing rather than the count being above zero.
Opening a message from the report
The subject opens the message in the quarantine view, where the whole decision can be made without going back to the console. The action menu offers Release, Release And Train, Blocklist Sender, Allow List Sender and Remove, and each does what the label says.
Release delivers the message and leaves the filter's opinion unchanged. Release and train delivers it and records that the message was legitimate. Allow list sender adds the address to the allow list, so nothing from it is held again. Blocklist sender is the opposite, and remove deletes the message without delivering it.
When to act, and when not to
Most entries need nothing. A report full of pharmacy and prize-draw subjects is a filter that is working, and the correct response is to leave it alone and close the message.
Act on the entries that are business mail. An invoice from a supplier you deal with, a notification from a system you run, or a reply from a customer is worth releasing, and training on it stops the same thing being held next month. Training and releasing a false positive covers the difference between the two actions in more detail.
If the same sender appears again the next morning, the fix is an allow entry rather than another release, and whitelisting a sender covers how narrow that entry should be.
Changing the schedule, and turning it off
The schedule lives in the filter console under Reporting, in Email Scout Reports, where the automatic reports are configured and the exclusions are listed. A report that arrives at an awkward hour is a schedule to change rather than a feature to disable.
Turning it off is reasonable where the console is checked anyway. It is the wrong choice where nobody opens the console, because the report is then the only notice that something wanted was held. Where a mailbox is shared by several people, the report is usually the only place the person who sent or expected the message will see it.
What it is not
It is not a backup and it is not the archive. It lists what is held at the moment the report is generated, and held messages do not stay in quarantine forever. A message that ages out is gone whether or not it appeared on a report.
The report is also not a delivery record. Mail that was refused outright never reaches quarantine and therefore never appears in it, and mail that was delivered normally is not mentioned. For the full picture of what happened to a message, the log search in the console is the place to look, and releasing a message from quarantine covers finding it there.