Skip to content
Webmaster Tools
EmailEmail DeliverabilityDMARC p=quarantine

DMARC p=quarantine

What a DMARC policy of p=quarantine does with failing mail, how pct helps you roll it out gradually, and what to check before you move from none to quarantine.

What p=quarantine means

p=quarantine asks receivers to treat mail that fails DMARC as suspicious. In practice that almost always means the spam or junk folder, though the receiver decides the details: some hold it in a quarantine area or score it more harshly. Mail that passes DMARC is not affected. It sits between p=none (monitor only) and p=reject (refuse the message).

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

A message passes DMARC (RFC 7489) when SPF or DKIM passes and the passing domain aligns with the domain in the From header. One aligned pass is enough.

What you see in the headers

Gmail shows the policy and what it did with the message:

Authentication-Results: mx.google.com;
       dkim=fail header.i=@example.com;
       spf=softfail smtp.mailfrom=example.com;
       dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=QUARANTINE) header.from=example.com

dis=QUARANTINE means the receiver applied your policy. Microsoft 365 writes something like dmarc=fail action=quarantine header.from=example.com. A receiver may override your policy, for example for mailing lists it trusts, and then the disposition is different. The Email Header Analyzer reads these headers for you.

Before you switch from p=none

  1. Collect aggregate reports for at least two weeks with rua=.
  2. List every legitimate source in them: your mailbox provider, marketing tool, CRM, ticketing system, invoicing, website forms.
  3. Make each one pass with alignment. Usually that means DKIM signing with your own domain (a CNAME or TXT at selector._domainkey) and, where possible, a custom bounce domain under yours so SPF aligns too.
  4. Check subdomains. Without an sp= tag, subdomains inherit p=. If news.example.com isn't ready, set sp=none for now.

Rolling out with pct

The pct tag applies the policy to a percentage of failing messages; the rest are treated as if the policy were one step weaker (here, none).

v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc-reports@example.com

Raise it to 25, 50, then 100 while watching the reports and user complaints. Note that some receivers apply pct loosely, so treat it as a rough dial. Removing pct is the same as pct=100.

Common problems after switching

  • Forwarded mail lands in spam. Forwarding breaks SPF, so only DKIM can carry the pass. Make sure every source signs with DKIM.
  • Mailing list posts fail. Lists that add a footer or subject tag break the DKIM signature. Many lists now rewrite the From address to avoid this.
  • A forgotten service sends from your domain without DKIM. Its mail now goes to spam, which is the policy working. Set it up properly instead of weakening the policy.
  • Wrong record name. The record must be at _dmarc.example.com, and there must be only one.

Next step: reject

When reports show no legitimate failures at pct=100, move to p=reject. Quarantine is a good safety net while you gain confidence, but only reject stops spoofed mail from reaching users at all.

Check your policy and its tags with the DMARC Checker, or the whole setup with the Email Checker.