Does Exchange Notify Senders When Malware Messages Are Quarantined?
Question details
Users want to know if senders receive notifications when Microsoft Exchange Online quarantines their sent emails due to suspected malware.
- Product
- Microsoft 365 Exchange Online
- Device & OS
- not provided
- Scenario
- A sender sends an email containing a potentially dangerous attachment, such as an SCR file, which appears in Sent Items but is not received by the recipient.
- Observed behavior
- The email is blocked or quarantined by Exchange Online as malware, but the sender does not receive any notification or bounce-back message indicating the failure.
You will need administrator access to the Microsoft 365 Defender portal and Exchange Admin Center to review or modify anti-malware policies and quarantine notifications.
Review Anti-Malware Policies in Microsoft 365 Defender
Administrators can check the anti-malware policy settings to see how sender notifications are handled when malware is detected.
By default, malware detections may not generate a notification to the sender. This is a deliberate security measure to prevent alerting malicious actors that their malware was intercepted. End-user notifications are typically configured for recipients regarding spam or phishing, not for senders sending malware.
Navigate to the Microsoft 365 Defender portal and log in using your administrator credentials.
Go to Email & Collaboration in the left menu, click on Policies & Rules, and then select Threat policies.
Under the Policies section, select 'Anti-malware' to view your organization's current malware protection policies.
Click on the default policy or your custom policy to open the details pane, then click 'Edit protection settings' to review if sender notifications are enabled or disabled.
Use Message Trace to Investigate Quarantined Emails
If a sender suspects their email was quarantined but received no notification, an admin can run a message trace to confirm its delivery status.
Try WPS Office for Secure Document Creation
While Microsoft 365 handles your email server routing and quarantine security, you can use WPS Office as a lightweight, free alternative for creating and editing your documents before sending them. WPS Office ensures high compatibility with standard formats while avoiding the trigger of email attachment security blocks.
Frequently Asked Questions
Why does my email show in the 'Sent Items' folder if it was quarantined?
The 'Sent Items' folder only confirms that your email client successfully handed the message over to the Exchange server. Server-level anti-malware scans happen after the email leaves your outbox, so the email will still appear in your Sent Items even if it is subsequently quarantined.
What types of file attachments are automatically quarantined by Exchange?
Microsoft 365 automatically blocks common executable and script files that are frequently used to distribute malware. This includes extensions such as .exe, .scr, .vbs, .bat, .cmd, and .js files.
Can the recipient release an email that was quarantined for malware?
No, end-users cannot release emails that are quarantined due to malware detections. For security reasons, only a Microsoft 365 administrator has the permissions to review and release malware-quarantined messages.
