Glossary
DMARC p=quarantine — Partial Enforcement Explained
DMARC p=quarantine tells receiving mail servers to send emails that fail DMARC authentication to the spam folder rather than the inbox. It provides partial protection — failing emails are separated from the inbox but not blocked entirely. p=quarantine is the recommended intermediate step between monitoring (p=none) and full enforcement (p=reject).
What p=quarantine Actually Does
When an email fails DMARC under p=quarantine:
- It goes to the recipient's spam folder
- It is not rejected or bounced
- You still receive aggregate reports showing the failure
Legitimate email from properly aligned senders is completely unaffected. Only failing email is quarantined.
What the Record Looks Like
_dmarc.yourdomain.com TXT
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
Gradual rollout with pct=:
v=DMARC1; p=quarantine; pct=10; rua=mailto:dmarc@yourdomain.com
pct=10 applies quarantine to 10% of failing mail. Use this to test before going to pct=100.
p=quarantine vs p=none vs p=reject
| Policy | What happens to failing email |
|---|---|
p=none |
Delivered to inbox — nothing blocked |
p=quarantine |
Sent to spam folder |
p=reject |
Blocked entirely — not delivered |
When to Move to p=quarantine
Move from p=none to p=quarantine when:
- You have at least 2 weeks of aggregate reports
- All legitimate senders show as aligned in reports
- No unexplained IPs sending as your domain
- Aggregate pass rate is 95%+
Run DNS Preflight to check your current DMARC policy and alignment status.
When to Move from p=quarantine to p=reject
Stay at p=quarantine for at least 1 week. If no legitimate email ends up in spam and reports show 99%+ pass rate — move to p=reject.
p=reject is the goal. It's the only policy that fully blocks spoofed email. See DMARC reject roadmap for a staged path.
The pct= Tag — Gradual Rollout
pct= applies the policy to a percentage of failing mail:
pct=10→ quarantine 10% of failurespct=50→ quarantine 50% of failurespct=100→ quarantine all failures (default)
Use pct=10 for the first week at quarantine. If nothing breaks, go to pct=100.
Check your DMARC policy in the browser
Check your DMARC policy →FAQ
What does DMARC p=quarantine mean?
Emails failing DMARC go to the spam folder instead of the inbox. Legitimate aligned email is unaffected. It's partial enforcement — between monitoring and full blocking.
Is p=quarantine safe to enable?
Yes — if your DMARC reports show all legitimate senders are aligned. Use pct=10 first to test on 10% of failing mail before going to 100%.
What is the difference between p=quarantine and p=reject?
p=quarantine sends failing email to spam. p=reject blocks it entirely. Start with quarantine, move to reject after a clean week.
Will p=quarantine affect my legitimate email?
Only if some senders aren't properly aligned. Fix all alignment failures at p=none first — then quarantine only affects unauthenticated email.
How long should I stay at p=quarantine?
At least 1 week. Check that no legitimate email is landing in spam. Once reports show 99%+ pass rate — move to p=reject.