What Is DMARC Quarantine? P=quarantine Policy Explained

Key Takeaways

p=quarantine is used to review suspicious emails while at DMARC enforcement without the risk of permanently losing legitimate emails.
Quarantined emails typically end up in the recipient’s spam or junk folder.
Regular review of DMARC reports is essential during this phase to ensure legitimate sources are properly authenticated.
The goal should always be to progress towards a p=reject policy for maximum protection against spoofing.

DMARC quarantine (p=quarantine) is the DMARC policy that tells receiving mail servers to deliver messages failing DMARC authentication somewhere other than the inbox. This usually means routing them to the spam or junk folder rather than blocking them outright.

What Is DMARC Quarantine?

DMARC quarantine is an enforcement policy specified within your domain’s DMARC record. When a sender transmits an email on behalf of your domain, the receiving email server checks the message against your published SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records. If the email fails these authentication checks and your DMARC policy is set to p=quarantine, the receiver is instructed to treat the email with suspicion.

Instead of rejecting the email completely or delivering it normally to the inbox, the receiver quarantines it. This action protects the recipient from potential phishing or spoofing attempts while still allowing the message to be delivered to a secondary folder.

How Is a DMARC Quarantine Policy Executed?

The execution of a DMARC quarantine policy involves a collaborative process between the sender’s published DNS records and the receiver’s mail transfer agent.

Policy Publication: The domain owner publishes a DMARC TXT record in their DNS containing the p=quarantine tag.
Authentication Check: Upon receiving an email claiming to be from the domain, the recipient’s mail server evaluates the SPF and DKIM signatures.
DMARC Alignment: The receiver checks for DMARC alignment. The domain used to validate SPF or DKIM must match the domain found in the visible “From” address.
Policy Application: If both SPF and DKIM fail, or if they pass but do not align with the “From” domain, the DMARC check fails. The receiving server looks up the DMARC record, sees p=quarantine, and applies the requested action.
Reporting: The receiving server generates aggregate XML reports detailing the authentication results and sends them to the email addresses specified in the rua tag of the DMARC record.

Where Do Quarantined Emails Go?

When a DMARC policy instructs a receiver to quarantine an email, the exact destination depends on how the receiving email provider has implemented their procedures. Quarantine is a recommendation, and providers handle it differently.

Google Workspace / Gmail: Quarantined emails are typically delivered directly to the user’s Spam folder. A warning banner is often displayed to the user indicating the email could not be verified.
Microsoft 365 / Outlook: Microsoft handles quarantine differently based on organizational settings. By default, quarantined messages often go to the user’s Junk Email folder. Administrators can also configure Microsoft Defender for Office 365 to route these messages to a centralized Microsoft 365 quarantine portal, where an administrator must review and release them before the end user can access them.
Yahoo: Similar to Google, Yahoo typically routes emails that fail DMARC under a quarantine policy to the user’s Spam folder.

A Step-by-Step Analysis of the DMARC Quarantine Policy Functioning

The functioning of the quarantine policy relies heavily on continuous monitoring and adjustment. When you move to a quarantine state, you must actively analyze the XML reports generated by receivers.

These reports highlight which sending IP addresses are failing authentication. You will likely discover legitimate third-party senders, such as your CRM, marketing platforms, or support ticketing systems, that were improperly configured. The quarantine phase allows you to identify these sources, fix their SPF or DKIM configurations, and verify the changes in subsequent reports without the catastrophic impact of bouncing their emails outright.

Importance of DMARC Quarantine Policy

The p=quarantine policy acts as a critical safety net. Transitioning directly from a monitoring phase to full enforcement is highly risky. If you have undiscovered legitimate sending sources, a reject policy will cause those important emails to fail without being noticed and disrupt business operations.

Quarantine allows you to test your email authentication posture in a real-world environment. It begins protecting your domain reputation by moving spoofed emails out of the inbox, yet it is forgiving enough that a misconfigured legitimate email can still be retrieved by the recipient if necessary. This builds confidence before making the final leap to reject.

DMARC Quarantine Examples

Here are common examples of how a DMARC record with a quarantine policy might look. You can use our DMARC record generator to create these, and our DMARC record checker to validate them once published.

v=DMARC1; p=quarantine; rua=mailto:[email protected];

A standard quarantine policy sending aggregate reports to a specified address.

v=DMARC1; p=quarantine; t=y; rua=mailto:[email protected];

A policy using the new DMARC testing tag (t=y). This tells receivers to treat failing emails as if the policy were one level lower (monitoring only) while you test your setup.

v=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected];

A policy that applies quarantine to the main domain but rejects failing emails claiming to be from subdomains.

The pct= Tag: How Much Mail Should You Quarantine?

Historically, the pct tag was used to create a staged rollout for enforcement. Instead of applying a policy to all failing emails, domain owners could specify a percentage.

The best practice involved a staged rollout ramp starting with a low percentage, such as pct=10. Administrators would monitor aggregate reports to see the impact. As they gained confidence that legitimate email was passing authentication, they would increase the percentage in stages (for example, to 25, 50, and 75) until they reached 100. Only then would they consider moving to a reject policy. A permanently low pct value leaves a significant portion of spoofed mail unenforced, defeating the purpose of DMARC.

Important Update: The Deprecation of pct

The DMARC specification has been formally updated with the publication of RFC 9989. Under this new standard, the pct tag is deprecated. Experience showed the tag was inconsistently implemented by receivers and often used improperly as a permanent safety net. DMARCbis replaces the pct tag with a simpler binary testing tag: t=y for testing mode or t=n for enforcement.

t=y: Tells receivers to treat a failing email as if the policy was one level lower. For example, if you publish a quarantine policy with t=y, receivers will treat it as monitoring only. This effectively replaces fractional rollouts.

t=n: Instructs the receiver to enforce the policy fully. This is the default behavior if the tag is omitted.

If you are setting up DMARC today, you should avoid the pct tag and prepare for DMARCbis compliance by using the testing tag.

When to Use p=quarantine (and When to Move On)

You should implement a quarantine policy only after spending sufficient time analyzing reports while your policy was set to p=none. The signal to move to quarantine is when your reports show that all known, legitimate sending sources are consistently passing DMARC alignment. If you leave your DMARC policy not enabled, you remain vulnerable to spoofing.

Quarantine is the crucial middle step between monitoring and enforcement. You should not, however, park on quarantine indefinitely. The risk of staying on quarantine is that spoofed emails still reach the recipient’s spam folder, where a user might accidentally open them or interact with malicious links.

The signal that you are ready to move from p=quarantine to p=reject is when your quarantine folder rates drop, and aggregate reports show nearly 100% compliance for your authorized senders. Message rejection should be rare for legitimate traffic before making the switch.

p=none vs p=quarantine vs p=reject

The three DMARC policies represent different stages of your email security journey. A policy of p=none is strictly for monitoring your traffic, while p=quarantine provides a middle ground that sends failing emails to the spam folder. The ultimate goal is p=reject, which blocks fraudulent emails before they are delivered.

Suggested read: Learn more about DMARC policies.

Frequently Asked Questions

What does p=quarantine mean in a DMARC record?

It instructs email receivers to treat emails that fail DMARC authentication with suspicion. Receivers typically handle this by delivering the failing emails to the spam or junk folder rather than the primary inbox.

Where do DMARC-quarantined emails go?

Depending on the receiver, such as Gmail or Yahoo, they usually go to the recipient’s spam or junk folder. In some corporate environments like Microsoft 365, they may go to an administrative Microsoft 365 quarantine portal.

Is DMARC quarantine the same as spam filtering?

No. Spam filtering evaluates the content and sender reputation of an email to guess if it is unwanted. DMARC quarantine is a specific action taken because the email cryptographically failed to prove it was authorized by the domain owner.

Should I use p=quarantine or p=reject?

You should start with quarantine to safely test your configuration. Your ultimate goal should be a reject policy for full protection against spoofing.

What percentage should I set with the pct tag?

Historically, administrators would start at a low number like pct=10 and ramp up to 100. The pct tag is deprecated in the new DMARCbis specification (RFC 9989), and you should transition to using the new testing (t=y) tag instead.

How long should I stay on p=quarantine before moving to reject?

You should stay on quarantine until your aggregate reports consistently show that all legitimate email sources are passing authentication. This typically takes a few weeks to a few months of monitoring and tuning.

About
Latest Posts

Yunes Tarada

Domain & Email Security Expert at PowerDMARC

Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.

What Is DMARC Quarantine? p=quarantine Policy Explained