DMARC Quarantine Policy (DMARC Quarantine)

Security Glossary - Email Authentication

Definition: The DMARC quarantine policy (p=quarantine) instructs receiving mail servers to treat emails failing DMARC authentication as suspicious. In practice, this means delivering them to the recipient's spam or junk folder rather than the inbox. It is the intermediate enforcement step between p=none (monitoring) and p=reject (blocking).

The Importance of DMARC Quarantine

Quarantine is the recommended stepping stone toward full DMARC enforcement. It provides real protection against spoofing (spoofed emails go to spam) while being less disruptive than reject if a legitimate email source is accidentally not authenticated. Users can still find misdelivered emails in their spam folder.

The pct tag can request a staged quarantine rollout, although receivers may still apply local policy to the remainder. Use aggregate reports and real message tests to understand impact before increasing coverage.

From the recipient's perspective, quarantined emails are in the spam folder with a note that the message failed authentication. This is visible enough to cause concern if legitimate emails are quarantined, but recoverable since the emails are not lost. This makes quarantine a good balance between security and operational safety during the DMARC deployment process.

How to Verify

A DNS health checker shows the published DMARC policy. Before moving from p=none, confirm every authorized sender through aggregate reports and real message tests. Choose any staged percentage from evidence and operational risk rather than a fixed recipe.

Check DNS Health

DMARC Quarantine FAQ

How long should I stay on p=quarantine before moving to p=reject?
There is no universal duration. Stay until aggregate reports and message tests cover all legitimate services and important mail cycles, and authorized messages align at full enforcement.
Will recipients know their email was quarantined?
Emails will appear in the spam or junk folder. Some email providers show authentication failure details. Recipients looking for expected emails may check spam, but many will not, so quarantine is not as reliable for delivery as inbox placement.
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.