A DMARC quarantine policy is the middle step between simply observing failures and rejecting every unauthenticated message. With p=quarantine, a receiving mailbox is asked to treat messages that fail DMARC with suspicion—often sending them to spam or a quarantine folder. It is a useful protection level when you have evidence that your real email is aligned and you want to reduce spoofing without taking the final enforcement step.
What quarantine does and does not do
DMARC uses aligned SPF or DKIM to decide whether a message claiming to be from your domain is authenticated. When that check fails, p=quarantine asks participating receivers to apply their suspicious-mail handling. It does not guarantee every receiver will use the same folder or action, and it does not fix a broken SPF or DKIM setup. It gives you a safer way to apply enforcement while continuing to watch results.
Start with evidence, not a policy target
Before moving from p=none, review DMARC aggregate reports or another reliable inventory of your legitimate senders. Identify staff mail, newsletters, billing, support, web forms, CRM mail, and agencies that use your domain. For each one, confirm that SPF or DKIM passes and aligns with the visible From domain. An unknown source may be an approved tool, a forgotten system, or actual spoofing.
Use a gradual rollout
DMARC supports a percentage tag, so you can start with a portion of failing mail. A record can specify p=quarantine; pct=25, then move higher after reports show no legitimate traffic is being affected. The correct reporting addresses and tags depend on your setup, so do not paste a record blindly. Keep the record syntax simple and change only one policy variable at a time.
When quarantine is a sensible choice
- You have completed a sender inventory and tested major senders.
- DMARC reports show aligned authentication for legitimate traffic.
- You are seeing spoofing or want a meaningful deterrent.
- You want a recovery margin before reject enforcement.
It may not be ready if a business-critical platform still fails alignment, reports are absent, or no one owns the DNS record. Review what a DMARC failure means before treating every failure as an attack.
Keep monitoring after the move
New vendors, email migrations, and DNS edits can change alignment later. Review reports after each rollout stage and test a fresh message from each major sender. Our DMARC policy comparison covers the differences among none, quarantine, and reject, while our DMARC record guide helps validate the public record.
Run Beacon’s free domain check to see whether your published authentication signals support a safer DMARC policy.
Understand alignment before enforcing
DMARC alignment is stricter than an authentication result that merely says pass. SPF must pass using an aligned envelope-from domain, or DKIM must pass with a signature aligned to the visible From domain. A third-party tool can show an SPF or DKIM pass while still failing DMARC because it uses the vendor’s identity instead of yours. Test messages from each system and read the authentication results together.
Decide who receives reports
DMARC reports are operational data, not a mailbox to ignore. Send them to a monitored address or reporting service and assign ownership. Review new or unknown sources, but do not assume every unrecognized IP is malicious—some are legitimate services that need investigation. The value of quarantine comes from pairing enforcement with this ongoing visibility.
Have a recovery plan
Keep access to the DNS host and the previous record value. If a verified business sender is unexpectedly affected, lower the percentage or return temporarily to monitoring while you correct its alignment. That is not a failure of DMARC; it is why gradual rollout exists.