Cloudflare Docs
Area 1 Email Security
Cloudflare Docs
Area 1 Email Security
GitHub icon
Visit Area 1 Email Security on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. Area 1 Email Security
  3. ...
  4. ...
  5. ...
  6. ...
  7. Use cases
  8. 3 - Junk email and administrative quarantine

Deliver emails to the junk email folder and administrative quarantine

In this tutorial, you will learn how to deliver Suspicious and Bulk messages to the users’s junk email folder, and Malicious, Spam, and Spoof messages to the administrative quarantine (this requires an administrator to release the emails).

​​ Configure domains

You first need to configure the domains you are onboarding on the Area 1 dashboard. To configure your domains:

  1. Log in to the Area 1 dashboard.
  2. Go to Settings (the gear icon).
  3. Go to Email configuration > Domains & Routing > Domains.
  4. Make sure each domain you are onboarding has been added.
  5. For each domain you are configuring, select … > Edit, and set the following options:
    • Domain - <YOUR_DOMAIN>.
    • Configured as - MX Records.
    • Forwarding to - This should match the expected MX record for each domain in your Office 365 account.
    • IP Restrictions - Leave this field empty.
    • Outbound TLS - Forward all messages over TLS.
    • Quarantine Policy - Do not check any dispositions.

​​ Create quarantine policies

To create quarantine policies:

  1. Open the Microsoft 365 Defender console

  2. Go to Email & collaboration > Policies & rules.

  3. Select Threat policies.

  4. Under Rules, select Quarantine policies.

  5. Select Add custom policy.

  6. Set the Policy name to UserNotifyAdminRelease.

  7. Select Next.

  8. In Recipient message access, select Set specific access (Advanced), and then:

    • In Select release action preference, choose Allow recipients to request a message to be released from quarantine.
    • In Select additional actions recipients can take on quarantined messages, select the Delete and Preview checkboxes.

    Configure the Recipient message access as stated in the step above

  9. Select Next.

  10. In Quarantine notification, select Enable.

  11. Select Next.

  12. Review your settings and select Submit.

  13. Select Done.

​​ Configure quarantine notifications

To configure quarantine notifications:

  1. Open the Microsoft 365 Defender console.

  2. Go to Email & collaboration > Policies & rules.

  3. Select Threat policies.

  4. Under Rules, select Quarantine policies.

  5. Select Global settings.

  6. Scroll to the bottom and set the desired frequency in Send end-user spam notifications every (days). This value can only be incremented in days.

    Configure the desired spam notification frequency

  7. Select Save.

​​ Configure anti-spam policies

To configure anti-spam policies:

  1. Open the Microsoft 365 Defender console.

  2. Go to Email & collaboration > Policies & rules.

  3. Select Threat policies.

  4. Under Policies, select Anti-spam.

  5. Select the Anti-spam inbound policy (Default) text (not the checkbox).

  6. In Actions, scroll down and select Edit actions.

    Go to Actions and find Edit actions

  7. Set the following conditions and actions (you might need to scroll up or down to find them):

    • Spam: Move messages to Junk Email folder.
    • High confidence spam: Quarantine message.
      • Select quarantine policy: UserNotifyAdminRelease.
    • Phishing: Quarantine message.
      • Select quarantine policy: UserNotifyAdminRelease.
    • High confidence phishing: Quarantine message.
      • Select quarantine policy: UserNotifyAdminRelease.
    • Retain spam in quarantine for this many days: Default is 15 days. Cloudflare Area 1 recommends 15-30 days.

    Select the spam actions in the above step

  8. Select Save.

​​ Create transport rules

To create the transport rules that will send emails with certain dispositions to Area 1:

  1. Open the new Exchange admin center.

  2. Go to Mail flow > Rules.

  3. Select Add a Rule > Create a new rule.

  4. Set the following rule conditions:

    • Name: Area 1 Deliver to Junk Email folder.
    • Apply this rule if: The message headers > includes any of these words.
      • Enter text: X-Area1Security-Disposition > Save.
      • Enter words: SUSPICIOUS, BULK > Add > Save.
    • Apply this rule if: Select + to add a second condition.
    • And: The sender > IP address is in any of these ranges or exactly matches > enter the egress IPs in the Egress IPs page.
    • Do the following - Modify the message properties > Set the Spam Confidence Level (SCL) > 5.

    Select the spam actions in the above step

  5. Select Next.

  6. You can use the default values on this screen. Select Next.

  7. Review your settings and select Finish > Done.

  8. Select the rule Area 1 Deliver to Junk Email folder you have just created, and Enable.

  9. Select Add a Rule > Create a new rule.

  10. Set the following rule conditions:

    • Name: Area 1 User Quarantine Message.
    • Apply this rule if: The message headers > includes any of these words.
      • Enter text: X-Area1Security-Disposition > Save.
      • Enter words: MALICIOUS, SPAM, SPOOF > Add > Save.
    • Apply this rule if: Select + to add a second condition.
    • And: The sender > IP address is in any of these ranges or exactly matches > enter the egress IPs in the Egress IPs page.
    • Do the following: Modify the message properties > Set the Spam Confidence Level (SCL) > 9.

    Select the spam actions in the above step

  11. Select Next.

  12. You can use the default values on this screen. Select Next.

  13. Review your settings and select Finish > Done.

  14. Select the rule Area 1 User Quarantine Message you have just created, and select Enable.