DMARC (Domain-based Message Authentication, Reporting and Conformance) helps protect domains against email spoofing and phishing attacks by defining how receiving mail servers should handle messages that fail authentication checks.
A quarantine policy is one of the three available DMARC policies:
p=none– Monitor onlyp=quarantine– Treat suspicious messages as spamp=reject– Reject suspicious messages completely
When a domain uses p=quarantine, receiving mail servers are instructed to treat messages that fail DMARC checks as potentially suspicious rather than delivering them directly to the recipient’s inbox.
Table of Contents
What Happens When DMARC Quarantine Is Enabled?
When an email is received, the destination mail server performs a series of checks.
Step 1: Check for a DMARC Record
The receiving server looks for a DMARC record in the sender’s DNS zone.
For example:
v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1This record tells receiving servers how to handle messages that fail DMARC validation.
Step 2: Verify SPF and DKIM
The receiving server checks whether the message passes:
- SPF (Sender Policy Framework)
- DKIM (DomainKeys Identified Mail)
These mechanisms help verify that the sender is authorized to send email on behalf of the domain.
Step 3: Verify Domain Alignment
DMARC also checks whether the domain used in the From address aligns with the domains validated through SPF or DKIM.
This process is known as domain alignment.
For example:
From: [email protected]The domain in the From address should match the domain authenticated by SPF or DKIM.
Step 4: Apply the DMARC Policy
If the message passes the required checks, it is delivered normally.
If the message fails DMARC validation, the receiving server applies the policy specified in the DMARC record.
With:
p=quarantinethe message is treated as suspicious.
Step 5: Move the Message to Spam or Junk
Instead of delivering the message directly to the inbox, the receiving server may:
- Move it to the Spam folder
- Move it to the Junk folder
- Mark it as suspicious
- Apply additional filtering rules
The exact behavior depends on the recipient’s email provider.
Unlike p=reject, the message is usually still delivered to the recipient’s mailbox, but not to the primary inbox.
Why Use a Quarantine Policy?
A quarantine policy provides a balance between monitoring and strict enforcement.
Benefits include:
- Protection against email spoofing
- Reduced risk of phishing attacks
- Improved domain reputation
- Lower likelihood of legitimate messages being blocked completely
Because messages are quarantined rather than rejected, administrators can monitor the impact of DMARC enforcement before moving to a stricter policy.
Example
Imagine an attacker attempts to send:
[email protected]but the sending server is not authorized in your SPF record and cannot generate a valid DKIM signature.
The message will fail DMARC validation.
If your DMARC policy is:
p=quarantinethe receiving server will typically place the message in the recipient’s Spam or Junk folder instead of the inbox.
When Should You Use Quarantine?
Many organizations implement DMARC in stages:
p=none– Monitor email traffic and collect reports.p=quarantine– Move suspicious messages to spam folders.p=reject– Block unauthorized messages completely.
This gradual approach helps identify legitimate mail sources before enforcing stricter policies.
Summary
A DMARC quarantine policy (p=quarantine) instructs receiving mail servers to treat messages that fail DMARC authentication as suspicious. Instead of being delivered directly to the inbox, these messages are typically placed in a spam or junk folder. This helps protect against spoofing and phishing attacks while reducing the risk of accidentally blocking legitimate email traffic.