Quarantine creates a second security decision
Holding a suspicious message back does not settle anything, it transfers the decision to somebody else.
The user reviewing their quarantine digest is making a security judgement with less context than the filter had, usually quickly, usually wanting the message. Release rates are high. A quarantine is a deferral, and its value depends on who ends up deciding and what they can see.
More on Email security
- DKIM protects signed content against later modificationChange one word, break the seal
- DMARC depends on alignmentBoth names, or neither
- Forwarding can break email authentication assumptionsIt was re-posted on the way
- A display name is not an email addressThey wrote that name themselves
- Reply-chain hijacking borrows existing trustTrust borrowed from the thread
- Secure email gateways see only traffic that reaches themIt only sees what comes past it