Hi all,
Robin Samson (@phonecoop.coopphonecoop.coop) got in touch asking why he stopped getting those “Spam Quarantine Notification” emails — the ones with a table of held messages and “release to inbox” / “delete” links. Turns out they’ve silently stopped going out, and we hadn’t told anyone.
a) What happened
I asked Claude to dig through the mailcow GitHub issues and community forum. This isn’t just us — it’s a recurring mailcow bug. There’s a well-documented history of the notifier (quarantine_notify.py, run via cron/ofelia) silently dying after upgrades, with nothing in the logs to flag it. One example from 2022: “same here, sending quarantine mail notifications stopped after upgrade to 2022-08(a)”, traced to a stale lock file. Another from 2024 on the community forum: “I’ve got the quarantine emails configured to be sent hourly but, while having emails waiting in quarantine, I receive no email about that.” And just two months ago, on 2026-07a: “All spams are being delivered to mailboxes after upgrade to 2026-07a and quarantine queue is always empty.”
So: almost certainly an update somewhere along the line broke it quietly, rather than anyone switching it off on purpose.
Also worth knowing — looking at old examples, these notifications weren’t only for stuff genuinely “Rejected.” The quarantine table lumps together rejected mail and ordinary spam that’s filed to Junk: for any action other than ‘reject’ an extra copy of the quarantined message is still delivered to the user’s Junk inbox,and the issue thread confirms that both rejected mail and Junk-folder spam end up stored in the same quarantine queue. So a chunk of the old “frequent” emails were really just noise about stuff already sitting in Junk.
b) My view: I think “off” is actually better — thoughts?
Here’s a couple of examples:
Look at them with fresh eyes — generic “quarantine@localhost” sender, no branding, a bare table, links inviting you to click “release” or “delete.” It’s basically indistinguishable in form from a phishing email. We’re telling people to be suspicious of exactly this pattern (unbranded sender + urgent-ish table + action links) in the new “is this email genuine” guide:
and then our own system was sending something that looks just like it.
I’ve told Robin we think not sending these is better for user safety, and that’s basically become our working position. But do we agree? Anyone think we should restore them instead?
c) If we keep it off — what about the Rejected threshold?
If we’re not notifying anyone when something is flat-out rejected, then a false positive there is completely silent — no Junk folder to check, nothing to see, just gone with a bounce to the sender. That’s a bigger deal than a false positive going to Junk, where at least the user can stumble across it.
So if “no emails” is where we land, I think the logical follow-on is: raise the global bar for Rejected quite a bit, so almost nothing except very obvious spam ever gets outright rejected, and push the uncertain stuff down into Junk where it’s at least recoverable. I had a poke around the global quarantine queue and there’s definitely ham sitting in Rejected right now, which isn’t great.
WDYT?
d) The alternative — turn notifications back on, but properly
The other option is: keep the current thresholds, but bring the emails back in a form that doesn’t look like phishing — mail.coop branding, clear sender address, better action links, explanatory text about what quarantine is.
Feasible?
Shaun