Message Center: Monitoring Held Messages

Document created by user.oxriBaJeN4 Employee on Feb 18, 2019Last modified by user.oxriBaJeN4 Employee on Apr 30, 2019
Version 11Show Document
  • View in full screen mode

This guide describes how to monitor and manage messages that haven't been delivered to the recipient and have been held as a result of a policy. Policies that hold messages include:

 

Held messages remain in the held queue for 14 days, after which they are removed from the queue and archived. We recommend messages are released, permitted, or blocked instead of allowing them to expire from the held queue. Held messages can also be viewed in Accepted Messages queue until the message is released, rejected, or expires automatically from the held queue.

 

Held Messages

 

Considerations

 

Take the following into consideration when monitoring held messages:

  • When a message is accepted for processing, a confirmation is issued to the sending server that the message was received. If a policy places the message on hold, the policy can be configured to issue a notification to the sender or recipient.
  • Blocked or rejected messages are stored in the archive, and are visible via an archive search. See Searching the Archive page for further details.
  • When a message is processed by us, it is scanned for spam / viruses and other checks are performed. If the message is placed on hold and subsequently released, an AV Scan on Release policy can be configured to scan the message's contents before it is delivered to the organization's email server.

 

Accessing the Held Messages Queue

 

To access the held messages queue:

  1. Log on to the Administration Console.
  2. Click on the Administration toolbar button.
  3. Select the Message Center | Held Messages menu item. The held messages queue contains the following tabs:
    TabDescription
    Overview

    Provides an overview of all held messages split into the following sections:

    • Held Reason: Lists all held reasons and the number of messages held for each one.
      Use the Search box to filter the list by entering a held reason.
    • Top Ten Held Reasons: Lists the top ten reasons why a message is held.
    • Messages Held by Group: Displays a graphical pie chart of the held messages.
    Held QueueDisplays a list of held messages, and allows you to release, reject, or report messages to the Mimecast Security Team for investigation. See the "Held Queue" section below for full details.
    Release LogsDisplays a list of the messages that have been released, rejected, or reported to the Mimecast Security Team for investigation. See the "Release Logs" section below for full details.
  4. Click on a Message to display its details in a slide out panel.

 

Filtering the Held Queue

 

You can filter the messages displayed in the held queue by using the:

  • Text boxes at the top of the tab.
  • Filters drop down.

 

To filter messages using the text boxes:

  1. Enter the required text in one or more of the filter fields.
  2. Select a Date Range.
  3. Click on the Search button.

Held Queue Filter

 

Filtering Held MessagesTo filter messages using the Filters dropdown:

  1. Click on the Filters drop down.
  2. Select the required filter options.
    Click on the Select All or Deselect All links to select / deselect all filter options.
  3. Click on the Apply button.
  4. Click on the Show drop down and select a number of records to display.

 

Releasing / Rejecting Held Messages

 

You can release held messages to the recipient or reject them from the held queue. This can be performed on one or more message.

 

To release / reject a single held message:

  1. Select the Held Queue tab.
  2. Click on a Message to display the Message Details panel. You can use the information in the following tabs to decide the action to take:
    • Details: Displays the message's transmission details (e.g. the sending server's IP address, DKIM signature, and sender / recipient details).
    • Message: Displays details of the message's body.
    • Header: Displays details of the message's header.
    • Transmission Data: Displays details of the message's envelope and transmission components.
    • Policies: Displays the policies that were applied to the message.
  3. Either click on the:
    • Release or Reject button to release / block the held message.
    • Release or Reject button arrow which exposes the following options:
      Menu ItemDescription
      ReleaseRelease the message to the recipient.
      Release to SandboxRelease the message to the sandbox. Once the message passes the sandbox inspection, it is sent to the recipient.
      Permit for RecipientAdds the sender to the end user's personal permitted senders list, and releases the message to be sent to the recipient.
      Reject

      The message is rejected (bounced) and removed from the held queue, but the sender and recipient aren't notified of the rejection. The message remains accessible in the archive.

      Reject (Notify Sender)The message is rejected (bounced) and removed from the held queue, and the sender is notified of the rejection. The message remains accessible in the archive.
      Block for Recipient

      The message is rejected (bounced) and removed from the held queue, and the sender is added to the end user's personal blocked senders list.

 

Releasing / Rejecting Help MessagesTo release / reject multiple held messages:

  1. Select the Tick Box to the left of the required messages.
  2. Either click on the:
    • Release or Block button to release / block the held messages.
    • Release or Block button arrow (see right) which exposes the options mentioned above.

 

Reporting Held Messages

 

You can report a message in the held queue to Mimecast's Security Team for analysis. This doesn't release the message to the recipient.

 

To report a single held message:

  1. Select the Held Queue tab.
  2. Select a Message.
  3. Held Messages Report MenuEither click on the:
    • Report button to report the message as spam.
    • Report Button Arrow (see right) which exposes the following options:
      • Spam
      • Malware
      • Phishing

 

To report multiple held messages:

  1. Select the Tick Box to the left of the required messages.
  2. Either click on the:
    • Report button to report the messages.
    • Report Button Arrow which exposes the options mentioned above.

 

Release Logs Tab

 

The release logs tab groups all held messages based on their held reason. This could either be because of a specific reason for holding the email (e.g. Suspicious Message Structure) or based on the policy that held it. For example, if you've two spam scanning definitions, one set to aggressive and the other to moderate, messages are grouped separately.

 

The release logs tab allows you to:

  • Determine if a specific policy is holding messages.
  • Review the messages held by a policy.
  • Display a list of the messages matching a policy.

 

See Also...

 

Attachments

    Outcomes