DMARC quarantine instructs receiving mail systems to treat failing messages as suspicious rather than deliver them normally. They may place them in junk or a similar holding area. Defenders use it as a step before full rejection, while checking for legitimate services that send on the organisation’s behalf and updating authentication records accordingly.
What DMARC quarantine actually does
Quarantine is one of DMARC’s enforcement modes. When a receiving system sees a message that fails DMARC and the domain owner has asked for quarantine, it should treat that message as suspicious rather than delivering it as ordinary mail. In practice, that usually means junk or spam placement, but each receiver can implement the policy with some variation.
The important point is that quarantine is a policy signal, not a guaranteed mechanical outcome. DMARC tells the receiver how to handle non-aligned mail from a domain that publishes the policy, while the receiver still applies its own filtering logic, mailbox rules, and local trust decisions.
Compared with p=none, quarantine is an enforcement step. Compared with p=reject, it is less strict and often used as an intermediate rollout stage when an organisation wants stronger protection without immediately dropping all failing mail.
What happens when a message fails DMARC
DMARC evaluates whether the visible From domain aligns with authenticated SPF and DKIM results. If alignment fails and the domain’s DMARC record says quarantine, the receiver should not treat the message as fully trusted. The receiver may move it to junk, mark it as suspicious, or otherwise reduce its prominence in the inbox.
That makes quarantine useful for reducing spoofing and lookalike mail exposure without creating the same operational risk as immediate rejection. It is especially helpful during rollout, because it gives defenders a chance to see whether legitimate senders are still failing authentication before they move to a stricter policy.
Quarantine also helps surface hidden sender dependencies. If a third-party service, marketing platform, ticketing system, or notification service sends on behalf of the organisation but is not correctly authenticated, those messages can start landing in spam folders. That is often a sign the organisation needs to update SPF, DKIM, or DMARC alignment for that sender rather than relaxing the policy.
Why quarantine is usually a staged control
Quarantine is commonly used as a transition point between monitoring and full enforcement. It lets defenders observe impact, identify broken senders, and confirm that the organisation has not overlooked a legitimate system that depends on domain-based email delivery. A staged rollout is the practical way to avoid breaking business mail while still raising the bar against impersonation.
For organisations that want a deeper rollout path, the broader DMARC, SPF and DKIM guidance on DMARC policy enforcement and sender alignment is the most direct companion reference. It is also useful to review email identity and BEC controls when the real concern is impersonation of finance, payroll, or executive mailboxes.
Risk and Threat Considerations
Quarantine reduces the chance that spoofed mail reaches users in a trusted-looking form, but it can also expose weaknesses in sender inventory and authentication coverage. The main operational risk is that a legitimate service is misconfigured, so important mail lands in junk while the organisation assumes enforcement is working.
Failure mechanism: A sender that is authorised in business terms but not aligned in SPF or DKIM fails DMARC, and the receiver applies quarantine even though the message was legitimate. Attackers can also exploit confusion during rollout by blending spoofed mail with poorly configured real senders.
Impact: Users may miss valid notifications, automated workflows may fail silently, and teams may become tempted to lower enforcement instead of fixing sender authentication. If the quarantine policy is used without sender discovery and remediation, it can hide both delivery problems and active impersonation attempts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | DMARC quarantine supports email sender control and account hygiene for legitimate senders. |
| Recommendation — Inventory authorised mail senders and remove unneeded sending paths. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | DMARC quarantine depends on managing the credentials and keys that authenticate mail senders. |
| AC-4 — Information Flow Enforcement | Quarantine is an enforcement action that alters how unauthenticated mail is handled. | |
| Recommendation — Rotate and protect mail-authentication secrets and signing keys. Enforce policy-based handling for messages that fail authentication checks. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Misconfigured mail senders often fail because signing material or SMTP secrets are exposed. |
| NHI-07 — Long-Lived Secrets | DMARC rollout often exposes stale mail-service credentials and keys that should be rotated. | |
| Recommendation — Protect email-sending secrets and monitor for leakage across third-party senders. Replace long-lived mail sender secrets with shorter-lived, rotated credentials. | ||
Practitioner Guidance
What to verify: Confirm which legitimate services send mail for the domain, then check that each one passes SPF or DKIM alignment in the way DMARC expects. Do not trust a quarantine policy until you have confirmed that critical business mail is not being diverted to junk by normal receiver behaviour.
Decision rule: If failing mail is mostly spoofing or obvious abuse, quarantine can be a sensible intermediate control while you prepare for rejection. If legitimate mail is failing, treat that as a sender-governance problem first, not a DMARC policy problem.
Practitioner takeaway: Quarantine is most valuable when it is used as a controlled enforcement step with active sender cleanup, not as a permanent compromise between monitoring and rejection.