How to troubleshoot B2B email quarantine issues with new dedicated IPs and strict security settings?
Matthew Whittaker
Co-founder & CTO, Suped
Published 13 Jul 2025
Updated 16 Aug 2025
6 min read
Moving to a new email service provider (ESP) with a new dedicated IP address can be a double-edged sword for B2B senders. On one hand, you gain greater control over your sender reputation. On the other, even if your domain has a sterling history, a fresh IP starts with no reputation, often leading to emails landing in quarantine or spam folders, especially with organizations that have strict security settings.
The challenge intensifies when targeting business domains. Unlike consumer inboxes, B2B email systems, often protected by advanced security solutions like Proofpoint or Mimecast, are inherently more cautious. They prioritize security and compliance, which means new, unproven IP addresses are frequently flagged, even if they're associated with a familiar, trusted domain.
Understanding these nuances is key to troubleshooting and resolving B2B email quarantine issues. I'll outline a comprehensive approach to navigate these strict environments and ensure your legitimate emails reach their intended recipients, rather than being caught in a blocklist (or blacklist) limbo.
Understanding the B2B quarantine challenge
Even with a well-established domain, a new dedicated IP starts with a neutral reputation. B2B mail servers are designed to be highly suspicious of unknown sending IPs, regardless of the domain's history. They often use a combination of IP reputation, domain reputation, content filtering, and authentication checks to determine if an email is legitimate or potential spam. When a new IP attempts to send a significant volume of emails, it can trigger these filters.
This is particularly true for organizations with stringent security policies. Their systems might automatically quarantine or block (blacklist) emails from any IP not yet recognized as a trusted sender. The challenge is often not about your content or domain, but the IP's lack of a positive sending history.
Understanding how various factors contribute to this initial filtering is crucial for effective troubleshooting. Issues can often stem from the IP's newness rather than any inherent problem with the email itself, especially when dealing with specific business domains or even Microsoft IP blocks.
New dedicated IP
IP reputation starts at neutral. Requires careful warming to build trust with recipient mail servers, especially Gmail and Outlook. Higher risk of initial quarantine or blocklisting.
Established domain
Domain reputation carries over, but it's not enough on its own. While the domain is familiar, the new IP's association with it needs to be proven over time through consistent, authenticated sending practices.
Essential email authentication for new IPs
Proper email authentication is the bedrock of deliverability, especially when introducing a new dedicated IP. Even if your main domain has SPF, DKIM, and DMARC records, a new IP requires these to be correctly configured for all sending subdomains as well. A common pitfall is having a DMARC record for the main domain but not for the specific subdomain used for sending, or a DMARC policy set to p=none with no alignment.
Strict B2B security filters (such as Microsoft 365 and Proofpoint) heavily rely on these authentication protocols to verify sender legitimacy. If any of these are misconfigured or missing for the sending IP and domain combination, your emails are far more likely to be quarantined or rejected. This is why a simple guide to DMARC, SPF, and DKIM is essential.
Google also emphasizes this. Their email sender guidelines specifically recommend setting up SPF, DKIM, and DMARC for better delivery. It's not just about having the records, but ensuring they are valid and that your emails align with them.
DMARC policy best practices
Subdomain DMARC: Ensure your sending subdomain has its own DMARC record, or that your main domain's record applies to subdomains via a sp=tag.
Alignment: Confirm that your From header domain aligns with your SPF and DKIM authenticated domains.
Gradual Policy Enforcement: Start with a p=none policy and monitor DMARC reports before transitioning to quarantine or reject.
IP warming is a critical, non-negotiable step for any new dedicated IP, especially for B2B sending. Unlike consumer mailboxes that might be more forgiving, business domains are particularly sensitive to sudden spikes in email volume from unknown IPs. If you don't warm your IP address appropriately, your emails are highly susceptible to being quarantined, throttled, or blocklisted (blacklisted).
The key is to start with low volumes and gradually increase them, monitoring deliverability closely. For B2B, the warming process can be slower than for B2C, as recipient servers are often more conservative. It's about building trust by demonstrating consistent, wanted email sending behavior over time.
Even with a good sender and the same domain they've been using for years, the new dedicated IP needs to earn its stripes. Mailbox providers and security solutions like Proofpoint or Mimecast don't automatically transfer domain reputation to a new IP. Each IP has its own reputation score that must be built from scratch. For more details on why this happens, consider reviewing why emails from new dedicated IPs land in spam.
Day
Volume
Days 1-3
100-500 emails per day, to highly engaged recipients
Days 4-7
500-2,000 emails per day, gradually expanding recipient list
Weeks 2-4
2,000-10,000+ emails per day, increasing volume as deliverability stabilizes
Sometimes, the issue isn't on your side, but rather with the recipient's internal security settings. Many B2B organizations have highly restrictive email filtering, and they may not automatically recognize a new IP, even if the domain is familiar. If you've confirmed that your authentication is solid and your IP warming is underway, a proactive step is to engage with the recipient's IT department.
Business domains often employ security solutions that scrutinize external senders heavily. Even an authenticated domain from an external source can encounter issues depending on the configuration of their filtering provider (e.g., Proofpoint, Mimecast, Barracuda). This is a common reason emails to O365 recipients get quarantined.
Requesting that your dedicated IP address (and sending domain, for good measure) be added to their internal allowlist (or whitelist) can bypass these initial filters. This is often the quickest resolution for persistent quarantine issues with specific B2B recipients. Providing clear instructions to their IT team can streamline this process significantly.
Guidance for recipient IT teams
Allowlist by IP: Request the IT team to add your dedicated sending IP address to their internal allowlist or connection filter policy.
Allowlist by Domain: Ask them to allowlist your sending domain and any subdomains.
Check Quarantine: Advise them to check their email quarantine (or blocklist) for your messages and release them.
Provide Authentication Info: Share your SPF, DKIM, and DMARC setup details, as these are often factors in their filtering decisions.
Views from the trenches
Best practices
Start with very low sending volumes to highly engaged segments of your list to build initial trust.
Ensure SPF, DKIM, and DMARC are perfectly configured for your new dedicated IP and sending domain, including subdomains.
Monitor your DMARC reports daily to identify any authentication failures or issues with your new IP.
Communicate proactively with key B2B recipients' IT departments to request allowlisting of your new IP and domain.
Common pitfalls
Sending high volumes too quickly from a new dedicated IP, leading to immediate quarantine or blocklisting.
Neglecting to configure DMARC for subdomains, even if the main domain has a record.
Assuming that an established domain reputation will automatically transfer to a new dedicated IP.
Failing to monitor blocklists (blacklists) and DMARC reports, missing early signs of deliverability issues.
Expert tips
Remember that even with an old domain, a new dedicated IP has to build its own reputation from scratch. This takes time and consistent, good sending practices.
For B2B sending, IP warming often needs to be more conservative and slower than for B2C, as business filters are typically stricter.
If emails are landing in quarantine, especially for internal company email addresses, it's frequently a local filter setting that needs adjustment by the recipient's IT admin.
Testing deliverability to domains outside your own organization can help differentiate between internal filter settings and broader deliverability issues.
Expert view
Expert from Email Geeks says to verify if a DMARC policy is in use and if messages are correctly authenticated. They also suggest checking with business domains outside of your own, as sending to your own domains adds another layer of complexity that can make it unclear if an issue is a filter setting or a local setting.
2023-05-12 - Email Geeks
Expert view
Expert from Email Geeks says that even with an authenticated domain, issues can arise when sending from an external source. Some providers, such as Mimecast, might not allow it depending on their configuration. If external testing looks fine, it's typically an admin fix needed on the customer's domain side.
2023-05-12 - Email Geeks
Taking control of your deliverability
Troubleshooting B2B email quarantine issues with new dedicated IPs requires a multi-faceted approach. It's a blend of diligent technical configuration, patient IP warming, and proactive communication with your recipients. By prioritizing strong authentication (SPF, DKIM, DMARC) for all sending domains and subdomains, and by carefully warming your new IP, you lay a solid foundation.
Engaging directly with your B2B customers' IT departments to request allowlisting can often bypass the most stubborn security filters. Remember, building trust with a new IP, even for an established brand, takes time and consistent positive sending behavior. Continuous monitoring and adaptation are key to ensuring your critical B2B communications consistently reach the inbox.
Proofpoint, Mimecast, 
Barracuda). This is a common reason emails to O365 recipients get quarantined.
