DMARC Quarantine

We verify billions of email addresses, and a domain’s DMARC policy shapes what happens to every message sent in its name. Quarantine sits in the middle of that policy: not passive monitoring, not an outright block, but a real consequence without the all-or-nothing risk of rejection. Here is what quarantine actually does, where it sits between the other two levels, and how to move into it without burying your own legitimate mail.

What DMARC quarantine means

Quarantine is the p=quarantine value published in a domain’s DMARC record, the DNS TXT entry at _dmarc.yourdomain.com. It is an instruction, not an action the domain owner performs directly: it tells every receiving mail server, “if a message claims to be from this domain but fails SPF or DKIM in a way that aligns with the visible From address, treat it as suspicious.” What “treat as suspicious” means is left to the receiver, but in practice nearly every major mailbox provider interprets it the same way: route the message to spam instead of the inbox.

That makes quarantine different from the other two policy values: it neither lets failing mail through silently nor stops it from being delivered at all. It is enforcement with a built-in safety net: the mail still arrives, just not where it was meant to land.

Where it sits in the DMARC policy ladder

A DMARC record supports exactly three policy levels, and they form a deliberate ramp rather than three unrelated options.

• None (monitor-only), written p=none, changes nothing about delivery. Failing mail still reaches the inbox exactly as it would with no DMARC record at all. The domain owner simply starts receiving aggregate reports about who is sending mail in their name and whether it passes alignment.
• Quarantine, p=quarantine, is the first level that actually changes what happens to a message. Failing, unaligned mail gets diverted to spam rather than delivered normally.
• Reject, p=reject, is full enforcement. Failing mail is blocked before it is ever delivered, the goal state for a domain that wants spoofing stopped completely.

That middle position is the entire reason quarantine exists. Jumping straight from no policy to full rejection means the first time you discover a misconfigured legitimate sender is when its mail stops arriving anywhere. Quarantine gives a domain a stage where enforcement is real but a mistake is recoverable: a message that lands in spam can still be found. One that is rejected outright cannot.

What happens to quarantined mail

When a message fails SPF or DKIM alignment against a p=quarantine policy, the receiving server does not bounce it and does not notify the sender that anything went wrong at the protocol level. The message is accepted during the SMTP conversation the same as any other mail, then routed internally to the recipient’s spam or junk folder instead of their primary inbox.

From the sender’s side, that is easy to miss: no hard bounce, no rejection error, nothing automated monitoring would flag. The mail simply underperforms — opens and clicks quietly drop — because a portion of it is filtered into a folder almost no one checks. That is why the aggregate reports a DMARC record requests aren’t optional reading. They are the only reliable way to see quarantine actually firing.

The risk of moving to quarantine too early

The failure mode with quarantine is not that it is too aggressive. It is that it is invisible when it goes wrong. A domain almost always sends mail through more sources than whoever configures DMARC remembers: a marketing platform, a support desk, an invoicing tool, a mailing list manager that forwards messages and breaks alignment. Any of those can be fully legitimate and still fail simply because no one has configured authentication for that source yet.

Publish p=quarantine before finding and fixing those sources, and their real mail starts landing silently in recipients’ spam folders. An invoice a customer never sees, a password reset that goes unnoticed, a newsletter with a quietly cratering open rate — all of it looks like normal underperformance rather than a policy misconfiguration, which is exactly what makes it easy to leave unfixed for months.

How to move to quarantine safely

The DMARC reporting system exists specifically to make this transition safe, and the standard path uses it in order rather than skipping ahead.

• Publish p=none first and let aggregate reports accumulate for a few weeks, long enough to see every recurring sending source, not just the obvious ones.
• Fix SPF or DKIM for every legitimate source the reports surface, until each one passes and aligns cleanly on its own.
• Move to p=quarantine, optionally ramping with a pct= tag so only a fraction of failing mail is affected at first.
• Keep reading the reports at quarantine. Once nothing but obviously spoofed mail is failing, raise pct= to 100 and, eventually, move to p=reject.

Done in that order, quarantine stops being a risk and becomes exactly what it is meant to be: a safe rehearsal for full enforcement, backed by real data instead of a guess. You can confirm a domain’s currently published policy at any point with the DMARC, DKIM and SPF check, and pair authentication with email verification so the addresses you send to are as sound as the domain you’re sending from.