DMARC glossary
What does p=quarantine mean in a DMARC record?
By Samuel Chenard · CEO & Co-Founder, Palisade · Reviewed August 16, 2026
p=quarantine tells receiving servers to treat messages that fail DMARC as suspicious — usually by routing them to the spam or junk folder instead of the inbox. It's the middle DMARC policy: stronger than none (which does nothing) but softer than reject (which blocks outright).
p=quarantine at a glance | |
|---|---|
| Tag | p (policy) |
| Valid values | none · quarantine · reject |
| Default | Required — there is no default policy value. |
| Where it goes | Immediately after v=DMARC1, e.g. v=DMARC1; p=quarantine; |
How p=quarantine works
quarantine is the first policy that actually does something to spoofed mail. Instead of delivering a failing message normally, the receiver sets it aside — in practice, the spam or junk folder. The message still exists, but it's out of the inbox and flagged as untrusted.
It's the natural second step in a DMARC rollout. After a spell on none confirms your legitimate senders all pass, moving to quarantine contains impersonation with a safety net: if you missed a legitimate source, its mail lands in spam rather than vanishing entirely.
RFC 9989 removed the old pct sampling tag. Stage a current rollout by using aggregate reports as the gate, applying quarantine only after every legitimate sender has run clean, and testing lower-volume subdomains before the parent domain.
Step 1
p=noneMonitor
Failing mail is still delivered — you only collect reports.
Step 2
p=quarantineContain
Failing mail is diverted to the spam or junk folder.
Step 3
p=rejectBlock
Failing mail is refused outright and never arrives.
Correct record vs common mistake
Correct
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.comFull quarantine with reporting on — every failing message is diverted, and you still receive the data.
Common mistake
v=DMARC1; p=quarantine; pct=25pct is a historic tag removed by RFC 9989. Receivers implemented it inconsistently, so this is not a dependable staged-rollout record.
Generate your DMARC record
Build the exact TXT record to publish — pick a policy, add a reporting address, copy. Free, no signup.
Used to show the exact host name to publish — the record itself doesn't contain it.
Start at none to observe, then tighten once reports look clean.
Where daily XML summaries are sent. Comma-separate multiple addresses.
Advanced options (sp, alignment, ruf)
Subdomains inherit p unless you set this. Attackers love unused subdomains — reject is a strong choice once you're at enforcement.
Relaxed allows subdomain matches (mail.yourdomain.com signs for yourdomain.com). Strict requires an exact match — most domains should stay relaxed.
Same idea for the SPF (Return-Path) domain.
Per-message failure samples. Rarely sent by large providers; contains message data.
Your DMARC record
Publish this as a TXT record in your DNS.
_dmarc.yourdomain.comv=DMARC1; p=none;Click the record to select all of it.
Record type: TXT · TTL: your provider’s default (e.g. 3600) is fine.
After you publish
- Add the TXT record at your DNS host and allow up to an hour for propagation.
- Verify it with the free DMARC checker.
- Watch your aggregate reports, fix SPF and DKIM for every legitimate sender, then step up to quarantine and reject.
Troubleshooting p=quarantine
| Issue | Likely cause | Fix |
|---|---|---|
| Legitimate mail landing in spam | A real sender isn't aligned — SPF or DKIM passes but for a different domain | Fix alignment for that source (correct SPF include or DKIM signing domain), then re-check reports |
| Spoofed mail still reaching inboxes | The receiver applied local handling, or a legacy pct tag weakened enforcement | Remove legacy pct after an interoperability review, confirm reporting is clean, then plan the step to reject |
| Users report 'missing' email | Quarantined messages sit in spam/junk, not bounced | Check the spam folder and message headers; if it's legitimate, align the source rather than whitelisting one-off |
Why it matters for MSPs
Quarantine is where a rollout can stall for years across a client base — “good enough,” so nobody pushes to reject. But spam-foldered spoofing is still spoofing: your client's brand can be impersonated, just one folder over. It's a waypoint, not a finish line.
Trusted by MSPs
“Their responsive support, agent task lists, white-label reporting, and centralized dashboard make managing our customer domains, effortless.”
Bobby Ghoshal — CEO, dupe.com
DMARC software that does the work
Palisade doesn't leave clients stuck at quarantine. It confirms every legitimate sender is aligned, then advances each domain to full reject on the evidence — across your whole tenant base at once.
1 domain free up to 1,000 emails/month
Questions readers ask