- p=quarantine, defined
- p=quarantine is the middle DMARC policy, asking receiving servers to deliver mail that fails authentication to the spam folder rather than the inbox.
Quarantine is the right step after monitoring because the damage stays recoverable. A message in a spam folder can be found and rescued; a rejected one is gone with only a bounce to show.
Combine it with the pct tag to move gradually. Start at pct=10, read a week of reports, then raise it as nothing unexpected appears.
How receivers implement it varies. Gmail files to spam, some corporate gateways hold the message for an administrator, and a few treat it as close to rejection.
The signal it sends matters beyond delivery. A domain at quarantine is visibly enforcing, which raises the cost of spoofing it enough that attackers usually move on.
How ZapBounce reports it
Our DMARC checker reports quarantine as partial enforcement and shows the pct value, since a quarantine policy applying to ten percent of failing mail is a very different posture from one applying to all of it.
The invoices that went quiet
Say you move to p=quarantine at full strength after a month of clean-looking reports. What you missed is the finance team's invoicing tool, which sends about 300 invoices a month with your address in the From line and the tool's own domain everywhere else. Those messages now fail DMARC and land in spam at every receiver that honors your policy.
Nobody gets an error. The tool shows 300 delivered. Your customers see nothing, and the first symptom is that payments arrive later than usual. It's a slower, stranger signal than a bounce.
The evidence is in your aggregate reports the whole time. Look for rows where disposition reads quarantine and the source IP belongs to a service you recognize. If a row carries an override reason such as forwarded or local_policy, the receiver chose a different outcome from the one you asked for, and the disposition tells you what it did.
Why quarantine is quieter than reject
A rejected message is refused during the SMTP conversation, so the sending system gets a 5xx reply and can show someone a bounce. Quarantined mail is accepted with a 250 and then filed as spam. From the sender's side, those two outcomes couldn't look more different: one makes noise and the other looks like success.
That has a practical consequence for the order you do things in. Quarantine is gentler on the recipient's side and worse for finding your own mistakes, because the feedback only exists in reports you have to go and read. If you're going to sit at quarantine for a few weeks, put a recurring reminder in the calendar to read them.
It also changes what you ask of colleagues. Before raising the percentage, get anyone who owns a tool that sends mail (finance, support, HR, the product team) to send you one real message from it. Check each one's headers for dmarc=pass, and you've tested in an afternoon what the reports would take a week to show.
p=quarantine: common questions
Where does quarantined mail go?
Usually the spam folder. Some corporate systems hold it for administrator review, and behavior differs by receiver.
Should I use pct with quarantine?
Yes, when starting. pct=10 exposes a tenth of failing mail to the policy so you can watch before committing.
Is quarantine enough, or should I reach reject?
Reject is the goal. Quarantine still delivers spoofed mail somewhere the recipient can find and open it.