Route suspicious mail into isolation, distance, and coordinated reporting

Mailrooms need a practiced response for a package that appears dangerous or releases an unknown substance. Recognition matters, but the safer operating priorities are to stop handling, isolate, create distance, protect exposed people, and contact the proper responders.

Integrated video surveillance and controlled entry at a modern commercial facility.
DSE visual intelligencePhysical securityChecklist · 4 min read
Executive summary

What you need to know

Mailrooms need a practiced response for a package that appears dangerous or releases an unknown substance. Recognition matters, but the safer operating priorities are to stop handling, isolate, create distance, protect exposed people, and contact the proper responders.

Potentially affected

Mailrooms, reception desks, shipping and receiving, executive assistants, schools, government-facing offices, remote sites, delivery areas, facilities, security, occupational safety, and employees who open letters or packages.

DSE recommendation

Place official suspicious-mail guidance at receiving points, define a hands-off isolation and emergency-notification sequence, plan for possible exposure, preserve delivery information, restrict re-entry, and exercise the handoff with local responders.

Source facts: recognition should lead to distance, not inspection

The United States Postal Inspection Service’s Suspicious Mail guidance describes dangerous mail as including mail bombs, hoax devices, suspicious substances, or other matter that may cause harm. It advises people who suspect a package to isolate the item, maintain a safe distance, wash their hands, and immediately call Postal Inspectors at 1-877-876-2455 and state “emergency.” When medical attention is warranted, it says to contact local authorities immediately.

USPIS Poster 84 lists possible indicators such as no return address, excessive postage or tape, misspelled or poorly written words, restrictive markings, an incorrect title, rigid or bulky shape, uneven or lopsided packaging, oily stains or discoloration, strange odor, protruding wires, or an unknown powder or substance.

A 2024 joint CISA, FBI, EAC, and USPIS mail-handling guide distinguishes an unopened suspicious item from a potential powder exposure. It advises people not to handle, shake, empty, or carry either condition. For powder already released, the guide says an available container may be placed over the mail piece or spill when this can be done safely, then left undisturbed for responders. That powder-control step is not a universal instruction for an intact or device-like package.

No single characteristic proves danger, and ordinary mail can have one or more listed features. The purpose of the indicators is recognition and escalation, not diagnosis. Postal Inspectors and local emergency responders have specialized authority and capability. Site personnel should follow their instructions and the local emergency plan rather than opening, moving, testing, cleaning, or disposing of the item.

DSE recommendation: give every receiving point the same stop-and-report sequence

Inventory where letters and packages actually enter: staffed mailroom, reception, loading dock, satellite office, school office, executive suite, home office, drop box, and after-hours delivery. Assign an owner and emergency contact path for each. Central screening does not protect a side entrance that accepts direct courier deliveries.

  1. Prepare the workspace. Keep emergency numbers, the official USPIS poster, location address, and room identifier visible. Maintain a way to restrict entry, communicate without approaching the item, identify nearby occupants, and meet responders. Do not create an unapproved “suspicious package bin” that encourages staff to carry an item.
  2. Stop handling and report the observed condition. If concern arises, place the item down gently if it is already in hand and follow the approved emergency procedure. Do not shake, squeeze, smell, taste, open, puncture, immerse, repackage, or transport it. Do not cover a device-like item or suspected explosive. If powder or another toxic exposure is possible—whether the mail piece is open or closed—avoid spreading it and follow the site plan and dispatcher’s instructions; approved guidance may direct covering the item or spill when this can be done safely.
  3. Isolate and create distance. Keep others away, close access to the area if this can be done without approaching or disturbing the item, and move to the site’s designated safe location. Do not allow a manager to enter for a second opinion.
  4. Report precise facts. Contact local emergency services and USPIS as directed by the plan. Provide the exact location, item appearance, whether it was opened or disturbed, any sound, odor, stain, wire, powder, liquid, vapor, illness, or written threat, number of potentially exposed people, and delivery information. State only what was observed.
  5. Protect potentially exposed people. Keep them available for responders while preventing unnecessary contact with others. Follow official instructions for handwashing, medical evaluation, clothing, ventilation, evacuation, sheltering, or decontamination. Do not improvise cleanup with a vacuum, fan, broom, water, or ordinary waste container.
  6. Preserve the delivery trail. Without approaching the item, retain available shipping records, manifests, tracking details, delivery time, carrier, witness names, and related communications. Restrict access to those records and provide them to authorized investigators.

Train people to recognize conditions and execute the first actions; do not ask them to identify explosive, chemical, or biological materials. Run announced tabletop exercises with a photo or card, never a realistic surprise package or powder. Test night-shift reporting, an unavailable supervisor, an item already opened, a person feeling ill, a direct executive delivery, and the need to guide responders to a remote entrance.

After responders release the area, document the incident timeline, instructions, people involved, operational impact, property disposition, medical or employee-support follow-up, communications, and corrective actions. Review uncontrolled delivery points and why the item reached them. Good suspicious-mail readiness turns uncertainty into fewer actions, not more: stop, isolate, create distance, report, and let qualified responders direct what follows.

Official references

Primary reference

Review the official source

United States Postal Inspection Service: Suspicious Mail Guidance and Poster 84 · Published September 1, 2006

Open official reference ↗
Plan the next step

Need help applying this guidance safely?

DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.

Talk with DSE