Investigate and recover
Review a reported message, understand its filtering decision and keep the evidence together while you decide what to do next.
Message evidence in one place
Inspect captured mail with its scan results, message content and structure. Operator-defined capture policies help collect the traffic relevant to an investigation without retaining every message indefinitely.
Second Chance for borderline mail
Give uncertain messages an additional AI review during the delivery retry window. Console shows the delayed queue, review results and eventual filtering decisions. Enable it for the traffic you intend to delay and review time-sensitive delivery requirements during setup.
Cases and follow-up
Keep an investigation's evidence, proposed correction and verification history together. A case gives the next operator context for the decision and a way to follow whether the correction addressed the reported problem.
Quarantine and recovery
Review retained quarantine messages and use the configured release integration when recovery is appropriate. Retention policies determine which messages remain available and for how long.
Optional AI assistance
Ask for an explanation of filtering evidence or help reviewing suspicious content. Use a supported local model endpoint for private analysis, or choose an optional hosted service after reviewing its data handling. Operators remain responsible for the decision.
Example workflow
Handling a reported false positive
- Find the retained message and inspect the original scan evidence.
- Record the assessment in a case and recover the message if appropriate.
- Propose a narrow policy correction and verify it against available examples.
Deployment considerations
Capture, quarantine and recovery must be configured for your mail platform. Expired or uncaptured messages cannot be recovered. An uploaded message is evidence to review, not an automatic spam or ham label.