DMARC Quarantine vs Reject: Which Policy to Use and When
DMARC quarantine and reject are enforcement policies, not inbox-placement settings. Both apply to messages that fail DMARC alignment; neither guarantees that passing mail reaches the inbox.
- p=quarantine asks the receiver to treat failing mail as suspicious, often by placing it in spam.
- p=reject asks the receiver to reject failing mail, usually during the SMTP transaction.
The right choice depends on how complete your sender inventory is and how much risk you can tolerate from an overlooked legitimate stream.
Side-by-side comparison
| Policy | Failing message | Benefit | Main risk |
|---|---|---|---|
| p=none | Delivered normally while reports are generated | Learn before enforcement | Spoofed mail is not blocked by your requested policy |
| p=quarantine | Treated as suspicious | Review and enforce with a recovery path | Legitimate mail may land in spam |
| p=reject | Rejected when the receiver honors the policy | Strongest anti-spoofing request | Legitimate mail can fail to arrive |
Receivers apply local policy. A receiver may quarantine or reject for reasons beyond DMARC, and it may accept a DMARC-failing message under its own rules.
Confirm alignment first
DMARC passes when SPF or DKIM passes and the authenticated domain aligns with the visible From domain.
| Message detail | What to check |
|---|---|
| Visible From | The domain recipients see |
| SPF | Envelope-from domain and SPF result |
| DKIM | d= signing domain, selector, and signature result |
| DMARC | Alignment result and applied policy |
| Source | Provider, application, or server that sent the message |
A provider-owned DKIM signature can pass while failing alignment with your brand’s From domain. Conversely, SPF can fail while aligned DKIM passes, allowing DMARC to pass. Inspect real headers and reports for each stream.
Safe rollout
Stage 1: monitor
Publish:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comCollect reports for a representative period. Look for old CRMs, support tools, billing systems, websites, and regional senders that no one remembered during the inventory.
Stage 2: quarantine
After legitimate sources are aligned:
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.comMonitor reports, bounces, support tickets, and test mailboxes. Quarantine is useful when you want a receiver-side review step while you validate the final gaps.
Stage 3: reject
When the reports and tests are clean:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comKeep monitoring after enforcement. A new vendor or forgotten integration can appear months later.
What about pct?
Google’s recommended DMARC rollout still shows pct examples for applying a policy to a portion of mail.
RFC 9989, published in May 2026, updates DMARC and removes pct from the updated policy-record specification because receivers did not apply intermediate percentages consistently. If your provider offers a supported staged rollout, use it; otherwise, use p=none for discovery and make an informed full-policy change. Do not assume pct=10 means exactly the same thing at every receiver.
When quarantine is the better choice
Choose quarantine first when:
- reports are mostly clean but one or two streams remain uncertain;
- you need time to correlate reports with application owners;
- the cost of missing a legitimate message is high;
- your receiving partners need a review period;
- your team can monitor spam placement and remediate quickly.
Quarantine is not a permanent “safe” setting if spoofing protection is the end goal. Treat it as an enforcement stage with an owner and a deadline.
When reject is appropriate
Move to reject when:
- every legitimate source is inventoried;
- SPF or DKIM is aligned for every source that uses the From domain;
- transactional and marketing streams have been tested;
- subdomains and third-party senders are covered;
- DMARC reports are being reviewed;
- support and operations know how to diagnose a failed sender.
If you cannot answer who owns a sending source, reject is premature.
Common failure modes
| Failure | Why it happens | Prevention |
|---|---|---|
| Password resets disappear | Transactional provider was not aligned | Test every critical flow before enforcement |
| Newsletters land in spam | Quarantine applies to a failing marketing stream | Fix DKIM/SPF alignment and review reports |
| Reports show an unknown sender | Forgotten vendor or spoofing | Investigate source and remove unauthorized senders |
| A new subdomain is unprotected | Policy assumptions were not documented | Set subdomain policy intentionally |
| Team thinks DMARC improves inbox placement | Policy was confused with reputation | Keep reputation and placement work separate |
FAQ
Does quarantine protect more than p=none?
It requests receiver-side treatment for failing mail, so it is an enforcement step. The exact folder or action remains up to the receiver.
Can reject block spoofing completely?
It is a strong request to reject failing mail, but not every receiver must apply it identically and not every abuse path uses your domain’s From identity.
Will a legitimate message fail if DKIM is broken but SPF passes?
Not if SPF passes and aligns with the visible From domain. DMARC needs one aligned path, but you should still repair the broken DKIM path.
How do I roll back?
Keep the prior record documented and have DNS access ready. If enforcement breaks a legitimate stream, return to p=none while fixing the sender, then resume the rollout deliberately.
For record syntax, see DMARC record examples; for the exact DNS host, see the DMARC TXT record guide.