Klytic

Home›Guides›Email security

Email security · Use Klytic MTA

Quarantine, false positives and reporting

Klytic MTA does not delete a suspicious message without leaving you in control: it delivers it, quarantines it, rejects it or defers it. A quarantined message is encrypted and can be released through a link valid for 7 days; every release and every report is taken into account for subsequent messages. This page is for the gateway administrator and for users who receive a quarantine link, whatever their email service.

Updated October 20266 minHow-to Klytic MTA

The filter’s four decisions

Klytic MTA sits in front of your email service, whether it is Klytic Mail, Microsoft 365, Google Workspace, Exchange or another server. Each incoming message receives one of these four decisions.

DecisionWhat happensWhat you can do
DeliverThe message arrives in the mailbox, with its score and reason in the headers. A dangerous attachment is removed and replaced with an information notice.Report it if it turns out to be malicious.
QuarantineThe message is isolated and encrypted. It does not arrive in the mailbox.Release it through the link received, or let it expire.
RejectThe message is refused. It is not kept.Nothing to release. If the sender is legitimate, the administrator adjusts a rule.
DeferThe message is put on hold briefly, for example because the sender is unknown. A normal sending server presents it again.Usually nothing: the message arrives slightly late.

Quarantine exists so that suspicious mail is not erased straight away. Deferral is not quarantine: it delays, it does not hold. On the sending side, a message can also be held for a few moments so it can be recalled; this delay is described in DKIM signing, S/MIME signing and recalling outgoing mail.

Who does what

  • The recipient user receives the quarantine notice in their usual email service, releases their own messages from the link and maintains their personal lists.
  • The domain administrator sets rules that apply to the whole domain, for example allowing a sender held for several colleagues. They also designate how to report a message.
  • Klytic operates the gateway, enables the features of your plan and provides support.

None of these steps goes through a Klytic webmail. The quarantine link arrives by email, in the email service the user already uses.

What happens to a quarantined message

The message is isolated and encrypted. It remains complete, attachments included, for the validity period of the release link: 7 days. After that, it can no longer be recovered from the gateway.

The recipient is notified according to the domain setting: a notice for each held message, or a periodic digest grouping pending messages.

Quarantine is not an archive. It replaces neither the archiving of your messages nor the backup of your email service. A released message then lives in your mailbox, like the others.

Releasing a message

  1. Identify the message. The quarantine notice lets you recognize the held message.
  2. Ask yourself whether it was expected. Do you know the sender? Were you expecting this document? If in doubt, check with the sender through a channel you already knew, such as their usual phone number, not by replying to the message.
  3. Release it from the link. One click is enough. The message is then delivered to your usual mailbox.
  4. Do not open it “just to see.” Do not open an attachment to check whether it is safe. If doubt remains, leave the message in quarantine and notify your administrator.

After a release, Klytic MTA takes your choice into account for subsequent messages. The link is personal: do not forward it.

When the same legitimate sender is held for several people, the domain administrator sets a sender rule for the whole domain, instead of letting each person release on their own. The division of roles is described in Who sets the filter in Klytic MTA.

Correcting a false positive

A false positive is a legitimate message treated as suspicious. Correction takes two steps:

  1. release the message from the link;
  2. add the sender to your personal allow list, so that their subsequent messages reach you.

The personal block list does the opposite: it screens out a sender who writes to you without being dangerous as such. Your administrator will tell you how to access these lists.

These lists concern only you. They are applied last, after the domain rules, and do not replace a rule set by the administrator.

Example. A regular supplier changes its invoice-sending tool. Its messages now come from another server and three people in accounting find them in quarantine. Before any release, the administrator calls the supplier on its usual number to confirm the change: a new invoice sender is also the classic starting point of a fraud. Once the change is confirmed, the administrator sets a rule for the domain. The three personal lists are not needed.

Reporting a message that reached the mailbox

A delivered message may turn out to be malicious: a fake supplier, a link to a fake login page. Report it. Your users’ reports improve filtering and reduce false positives.

The reporting method is defined for your domain; your administrator will tell you what it is. Until you report it:

  • do not click on the links and do not reply;
  • do not forward the message to colleagues to get their opinion;
  • if you have already clicked or entered a password, notify your administrator immediately.

For the administrator: Klytic MTA acts on mail in transit. It does not remove a message already delivered to mailboxes. If the same message was delivered to several people, the cleanup is done in your email service, by its administrator.

With the Advanced plan, links are also rescanned at the time of click. A message delivered because it appeared safe may therefore have its link blocked later, if the site became dangerous in the meantime. This is the expected behavior: report that message.

What your plan includes

FeatureEssentialAdvanced
Encrypted quarantine, secure release and notificationsIncludedIncluded
Dangerous attachments removed, with an information noticeIncludedIncluded
Per-user allow and block listsIncludedIncluded
Learning from reports, AI arbitration of ambiguous messagesIncludedIncluded
Links rescanned at time of clickNoIncluded
Booby-trapped HTML files and text hidden in imagesNoIncluded
SMS alert when an important sender writes to youOptionOption

Prices are on the Pricing page.

Limits

  • A quarantined message expires with its link, after 7 days. Beyond that, ask the sender to resend it.
  • A rejected message is not kept: there is nothing to release.
  • The gateway does not remove a message already delivered to mailboxes.
  • A personal list applies only to its owner. Anything that applies to everyone is a matter for a domain rule.

To recognize the threats themselves, see Spam, phishing, malware and compromised accounts.

Frequently asked questions

Why is an expected message in quarantine?

The reason for each decision is recorded. The administrator can read it: see Reading and exporting a filter decision.

Can I recover a message after 7 days?

No, the gateway no longer keeps it. Ask the sender to resend it. Details of the retention periods are in Retaining and reviewing email security logs.

Do I need a Klytic Mail mailbox to use quarantine?

No. Quarantine works in front of any email service. See Protecting the email system you already have.

Does my allow list take precedence over a domain rule?

No, it does not replace it. The order of the rules is described in Who sets the filter in Klytic MTA.

How do I recognize CEO fraud?

See Impersonation and CEO fraud.

A question about your quarantine?

Klytic support answers by phone in French, and by email in all languages.

Contact support →

The Klytic MTA offer

Further reading

Understand · Email securitySpam, phishing, malware and compromised accountsFour threats come through the same door and are not handled the same way. What gives each one away, what stops it, and why anti-spam alone is no longer enough.6 min readRead →Use · Email securityReading and exporting a filter decisionRead the score and reason behind a Klytic MTA decision in the headers, export logs to a SIEM, and know what the audit trail retains.5 min readRead →Use · Email securityWho sets the filter in Klytic MTAThe five rule tiers in Klytic MTA, their order, and who sets each one: the operator, the domain administrator or the user.5 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing