Email Security Banners, Held Messages, and Blocked Senders
Explore the importance of email security banners, managing held messages, and understanding blocked senders to enhance your email safety.
Table of Contents
Email Security Banners, Held Messages, and Blocked Senders
Effective September 2026 | Last Updated on 1st September | Published by Parnav Dagar
INKY is the email security layer Verito deploys in front of your Microsoft 365 or Google Workspace mailboxes on VeritGuard Pro and Elite plans. It inspects every inbound message and adds a coloured banner at the top so you can see, before you act, what it found.
This article explains what the banners mean, what to do when a legitimate sender keeps getting flagged, where a missing message has gone, and how to check a message you are unsure about. Allow list and quarantine changes are made by Verito on your behalf, so those sections tell you exactly what to send us so we can act on the first reply.
1. What the banner colours mean
| Banner | What it means | What you should do |
| Grey | The message came from outside your firm and INKY found no threat indicators. This is context, not a warning. | Proceed normally. |
| Blue | The sender is on your firm's Known External Senders list, meaning a regular business contact already marked as trusted. | Proceed normally. |
| Yellow (Caution) | Something is worth a second look. Common reasons are a first-time sender, an unusual request, or bulk and marketing characteristics. | Read the reasons listed in the banner, then apply the checks in section 4 before acting on anything financial. |
| Red (Danger) | Strong phishing or malware indicators. Messages at this level are held in quarantine and are not delivered to your inbox. | You should not encounter one in your inbox. If you do, do not click anything and call us. |
One detail that explains a lot of confusion: first-time sender tracking is per mailbox, not per firm. If a colleague has corresponded with a contact for months and you have not, you will see a first-time sender caution on your copy and they will not see one on theirs. Nothing is wrong and nothing needs fixing.
2. A legitimate sender keeps getting flagged
Allow list entries are managed by Verito, not from your mailbox. Send us a ticket with the details in section 6 and we will create the entry. Tell us whether the sender should be trusted for you alone or for everyone at the firm, because those are two different changes and we will make the narrower one unless you say otherwise.
We will also ask what the message actually is, and that is deliberate rather than a delay. An allow list entry suppresses specific categories of warning for a specific sender. Suppressing a spam warning on a newsletter is routine. Suppressing a phishing warning is not something we will do to resolve a nuisance, because it removes a control that exists to protect client data. Knowing what you are expecting from that sender lets us make the narrowest change that solves the problem.
Two options we may use
| Change | When it is the right fix |
| Allow list entry | A legitimate sender is being misclassified, for example a subscribed newsletter or a portal notification landing in Junk. |
| Known External Senders | The sender is not being misclassified, but they are a frequent business contact and the repeated caution banner has become noise. This converts their banner to blue. |
One thing we cannot do, and it is worth saying plainly: banners cannot be switched off for a single sender while remaining on for everything else. Banner display is a firm-wide setting. Known External Senders is the closest equivalent, and it reduces the visual noise while keeping the protection in place.
3. A message never arrived
INKY does not hold mail itself. It analyses each message and instructs Microsoft 365 or Google Workspace where to deliver it. A missing message is therefore usually in one of two places.
| Where it went | Why | How to get it back |
| Junk Email folder | Classified as spam or bulk mail. It was delivered, just not to your inbox. | Check Junk Email first and move the message to your inbox yourself. If the same sender keeps landing there, send us a ticket and we will stop it recurring. |
| Quarantine | Classified as phishing or malware. These are held before delivery and do not appear in any folder in your mailbox. | Contact Verito. Releasing a quarantined message requires administrator permissions, so this cannot be done from your mailbox. |
When you ask us to release something from quarantine, we review why it was held before releasing it. A message reaches quarantine because it showed phishing or malware indicators, so this is not a formality. If our review finds the message is genuinely malicious we will tell you, and we will check whether anyone else at the firm received it.
If the message is in neither Junk nor quarantine, it is a mail delivery question rather than a security one. Send us the details in section 6 and we will trace it.
4. Checking a message you are unsure about
A caution banner means look closer, not that the message is fake. The reverse also holds: a grey banner is not a guarantee. Use the banner as a prompt, then judge the message on its own merits.
- Read the actual sending address, not the display name. Display names are trivial to fake. Lookalike domains that add, drop, or swap a single character are the most common technique used against accounting firms.
- Read the reasons listed in the banner. INKY names what it found, such as first-time sender or suspicious content.
- Hover over links to see the real destination before clicking.
- Be sceptical of a reply that appears inside an existing conversation but changes the subject to money or credentials. Attackers who compromise one mailbox frequently reply into genuine threads.
- Treat any request to change bank details, wire funds, send a client file, or purchase gift cards as suspect regardless of who it appears to be from, including a partner at your own firm.
- Verify by telephone using a number you already hold from another source. Never verify by replying to the message, and never use a phone number contained in the message itself.
- If you are still unsure, send it to us. That is the correct outcome, not a last resort.
| If you have already clicked a link, opened an attachment, or entered your password, stop what you are doing and call 844-629-9899 immediately. Do not wait to open a ticket. Speed matters far more than certainty at that point, and there is no penalty for calling about something that turns out to be harmless. |
5. Reporting a phishing message
Send suspected phishing to itsupport@verito.com as an attachment rather than a plain forward. A plain forward strips the technical headers we need to trace where the message originated and to determine whether other mailboxes at your firm received it.
In Outlook, create a new message, then drag the suspect message from your mailbox into the body of the new one. That attaches the original intact. If you are unable to do that, tell us and send a screenshot instead, and we will retrieve the original from the server.
6. What to include when you contact us
Sending these details in your first message avoids a round trip and lets us act immediately:
- The full sending email address, not just the sender's name.
- The subject line.
- The date and approximate time the message was sent or expected.
- Which mailbox was affected.
- Whether this needs resolving for one person or for the whole firm.
- What you are expecting from that sender, for example an invoice, a portal notification, or a newsletter.
- A screenshot of the banner, if the message reached your inbox.
7. Support contact
Managed IT support is available 24 hours a day, 7 days a week.
- Email: itsupport@verito.com
- Phone: 844-629-9899
For a suspected security incident, call rather than email.