When does a DMARC quarantine policy create more risk than it reduces?

When quarantine stops being a control and starts becoming a delivery path

DMARC quarantine is useful when it meaningfully reduces inbox exposure without creating false confidence. It becomes riskier than reject when users still see suspicious mail in a place they trust enough to inspect, act on, or forward. That is especially true when attackers can mimic payment requests, login alerts, or other “urgent but plausible” messages that users are trained to check.

Quarantine is also a weak fit when the organisation treats spam filtering as the end state instead of a transitional control. If the domain already has strong authentication, but unauthorised mail still lands in a visible junk folder, the attacker still gets a delivery channel. In practice, the control only reduces risk when people do not routinely interact with quarantined messages as if they were merely lower priority mail.

Why quarantine can increase exposure in real mail workflows

Quarantine creates a second decision point for the recipient, and that decision point is where abuse happens. A message that was blocked from the inbox may still be visible in a mail client, mobile notification stream, or “spam” folder, which can be enough for a convincing impersonation attempt to work. If users are accustomed to checking spam for false positives, the attacker benefits from that behaviour.

The control also creates uneven outcomes across the organisation. Some users will ignore quarantined mail, some will release it, and some will respond to it. That inconsistency makes quarantine less predictable than reject. For externally facing teams, vendor managers, finance staff, and support teams, quarantine can preserve just enough reach for phishing, invoice fraud, and look-alike sender abuse to remain effective.

When quarantine is the wrong end state

Quarantine is most defensible as a temporary step while authentication alignment, sender reputation, and user handling are being improved. It is the wrong end state when the organisation has already observed stable DMARC alignment for legitimate senders, but still leaves spoofed mail available in the spam folder. At that point, the remaining exposure is not hypothetical, it is operational.

It is also the wrong end state when the business depends heavily on email for time-sensitive external communication and cannot reliably distinguish authentic exception mail from malicious look-alikes. In that environment, quarantine can produce both false negatives and false expectations: legitimate mail is delayed, and suspicious mail remains accessible to the very users who are easiest to pressure.

A Email Identity and BEC Guide is the most directly relevant place to study how spoofing, mailbox trust, and payment verification controls interact with DMARC enforcement.

Risk and Threat Considerations

Quarantine raises risk when it preserves a usable channel for social engineering while giving teams the illusion that spoofing has been “handled.” The main danger is not that every quarantined message is dangerous, but that a small number of highly plausible messages can still reach people who are already primed to monitor spam and release missed mail.

Failure mechanism: Attackers exploit the residual visibility of quarantined mail, then use urgency, imitation, and familiar sender patterns to trigger action before users question the message’s legitimacy.

Impact: The organisation can experience credential theft, invoice fraud, or business email compromise even though the message never reached the primary inbox, which means the control reduced exposure only partially rather than decisively.

Practitioner Guidance

What to verify: Treat quarantine as acceptable only if you have evidence that legitimate mail sources are aligned, exception handling is controlled, and users do not routinely act on spam-folder content. If quarantined mail is frequently released or answered, the control is already behaving like an alternate inbox rather than a protective boundary.

Decision rule: If the organisation can move to reject without creating material business disruption, do so for spoofed domains that are no longer needed for delivery. Keep quarantine only for a defined transition period, for uncertain senders, or where you still need a monitored recovery path for false positives.

What practitioners underestimate: The most dangerous part of quarantine is often human behaviour, not the mail filter. A folder labelled “spam” can still be treated as a place for legitimate exceptions, and that habit gives attackers a realistic place to hide.

Practitioner takeaway: Quarantine is safest when it is temporary, actively reviewed, and paired with a clear move to reject; otherwise it can become a trusted side channel for phishing rather than a true reduction in attack surface.

Related resources from NHI Mgmt Group

• Why do non-human identities create more risk than many human accounts?
• Why do non-human identities create more remediation risk than many human accounts?
• When does a single throttling policy create more risk than it reduces in identity systems?
• When does Content Security Policy create more risk than it reduces in a Rails application?