Mail continues to be blocked by Anti-malware service after sending for rescan

Products

• Email Security.cloud

Issue/Introduction

You are unable to release the emails that are in quarantine. Emails continue to be blocked after sending for rescan.

Environment

Email Security.cloud

Resolution

If the message is clean on rescan, then it is delivered to its original recipient. If the message still contains malware or triggers a Scan-time Protection Policy rule, then it is quarantined again.

Possible rescan outcomes:

• Message is now clean - The message is sent to its original recipient, and its status in Administrator Quarantine is changed to 'Sent to rescan'.
• Malware is detected - The message is assigned a new Pen ID and returned to Administrator Quarantine, and its status is shown as 'New'. If you believe that the detection is a false positive, submit it to the Malware Submissions page in the portal (related article) or contact technical support.
• Message could not be submitted for rescan - The message remains in Administrator Quarantine with the status of 'Rescan Failed'.

While releasing emails from Administrator Quarantine, the Release Emails dialog appears. You can specify whether to release them to the message’s original recipient, or to an alternate email address you specify.

Additional Information

Related article:
Releasing Legitimate Emails Quarantined by Anti‑Malware Service