Does 'p=quarantine' deliver mail to the inbox or spam folder?
Michael Ko
Co-founder & CEO, Suped
Published 9 May 2025
Updated 14 Oct 2025
8 min read
When you implement a DMARC policy of p=quarantine, the straightforward answer is that mail failing DMARC authentication will generally be delivered to the recipient's spam or junk folder, not the primary inbox. This policy serves as a strong suggestion to receiving mail servers, indicating that unauthenticated emails purporting to be from your domain should be treated with suspicion.
However, it's crucial to understand that p=quarantine does not guarantee placement in the spam folder, nor does it guarantee complete blockage. Instead, it instructs email providers to consider placing messages that fail DMARC checks into the spam or junk folder, or a dedicated quarantine. The final decision often depends on the recipient's specific mail server configuration, other security measures, and the sender's reputation.
This policy offers a middle ground between p=none (monitor only) and p=reject (block entirely). It allows you to protect your domain from impersonation while still giving you time to analyze DMARC reports and ensure all legitimate mail sources are properly authenticated. This article explores the nuances of p=quarantine, its implications for deliverability, and why proper monitoring is essential.
Understanding DMARC p=quarantine
DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol that helps protect your domain from email spoofing and phishing attacks. It builds upon existing protocols like SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) by providing instructions to receiving mail servers on how to handle emails that fail authentication and providing feedback to the sender about these failures. A good overview of these protocols can be found in a simple guide to DMARC, SPF, and DKIM.
When you set your DMARC policy to p=quarantine, you are essentially telling email receivers, "If an email from my domain fails DMARC checks, don't reject it outright, but treat it as suspicious." This typically means the email will be placed in the spam or junk folder, or a dedicated quarantine area, awaiting review by the recipient or their security systems. It allows for a cautious approach to DMARC enforcement.
The primary goal of p=quarantine is to achieve a level of protection against malicious email without immediately risking the blocking of legitimate mail that might be failing DMARC due to misconfigurations. This makes it an ideal stepping stone when you are transitioning to a more protective DMARC policy, allowing you to gather data and fix issues before moving to p=reject. A complete list of DMARC tags and their meanings can help you understand all available options.
While p=quarantine instructs mail servers to move non-compliant emails to spam, the actual delivery outcome can vary. Most major mailbox providers, like Gmail, Outlook, and Yahoo, respect the quarantine policy and will typically place failing emails in the junk or spam folder. However, this isn't an absolute rule. The recipient's mail server ultimately makes the decision, factoring in other signals.
How ISPs interpret p=quarantine
Internet Service Providers (ISPs) typically treat a p=quarantine policy as a strong recommendation to either send emails to the spam folder or place them in a holding queue for further review. This decision is influenced by:
Sender reputation: A poor reputation can lead to a stricter interpretation.
Content analysis: Spam filters will still scan for suspicious content.
Recipient engagement: Prior interactions with the sender's domain.
Other authentication results: Whether SPF and DKIM passed, even if DMARC failed alignment.
Email security platforms, acting on behalf of recipients, often have sophisticated quarantine systems. Emails that fail DMARC with a p=quarantine policy may be held in these systems for administrators to review. This is particularly common in corporate environments. You can learn more about how DMARC policies affect delivery outcomes by reading about DMARC quarantine vs. DMARC reject on Fortra's blog.
Why DMARC p=quarantine is important for security
Adopting a p=quarantine policy is a critical step in enhancing your domain's email security. It effectively combats phishing and spoofing attempts by signaling to receiving mail servers that emails failing authentication should not be trusted for direct inbox delivery. This helps protect your brand reputation and your recipients from malicious actors impersonating your domain.
DMARC p=quarantine
Emails failing DMARC typically go to spam or junk folder.
Offers strong protection against spoofing with reduced risk of legitimate email blocking.
Allows time to identify and fix unauthenticated legitimate sending sources.
DMARC p=reject
Emails failing DMARC are blocked entirely at the receiving server.
Provides the highest level of protection against malicious email.
Carries a higher risk of blocking legitimate emails if misconfigured.
The choice between p=quarantine and p=reject depends on your confidence in your DMARC configuration and the data from your DMARC reports. For many organizations, p=quarantine is the logical next step after a period of monitoring at p=none. It allows you to continue refining your email authentication without causing significant disruptions. Understanding how DMARC policies affect sender reputation and email delivery is essential for making this decision.
Moving to p=quarantine: Best practices
The recommended approach to DMARC implementation is a gradual one, starting with a p=none policy to collect data, then moving to p=quarantine, and finally to p=reject. This phased approach minimizes the risk of legitimate emails being blocked or sent to spam. A successful transition to p=quarantine relies heavily on diligent monitoring and analysis of DMARC reports.
Monitor DMARC reports: Regularly review your DMARC aggregate reports to identify all legitimate sending sources and ensure their SPF and DKIM authentication is aligned with your DMARC policy. This is a crucial step for any DMARC journey.
Analyze data carefully: Look for any legitimate email streams that are failing DMARC. These need to be identified and fixed before moving to a stricter policy. Tools that offer detailed insights, such as Suped, can greatly assist in this analysis.
Adjust policies and configurations: Update your SPF and DKIM records for any legitimate senders that are currently failing DMARC. This ensures they pass authentication before moving to p=quarantine. Guardian Digital's blog offers a comparison of DMARC quarantine vs reject.
By following these steps, you can confidently transition to a p=quarantine policy, knowing that your legitimate emails are correctly authenticated and malicious emails are being handled appropriately. For more detailed guidance, see our article on how to safely transition your DMARC policy to quarantine or reject.
The Suped advantage for DMARC monitoring
Implementing DMARC, especially moving to an enforcement policy like p=quarantine, can be complex without the right tools. Suped offers a comprehensive DMARC reporting and monitoring solution designed to simplify this process, providing clarity and actionable insights.
Suped's AI-powered DMARC monitoring
AI-Powered Recommendations: Get clear, actionable advice to fix DMARC issues and strengthen your policy automatically.
Real-Time Alerts: Receive immediate notifications about DMARC failures or potential threats.
Unified Platform: Monitor DMARC, SPF, and DKIM, alongside blocklist and email deliverability insights in one place.
SPF Flattening: Simplify complex SPF records to avoid the 10-lookup limit and improve deliverability.
MSP and Multi-Tenancy Dashboard: Manage multiple client domains from a single, intuitive interface, perfect for agencies and MSPs.
Suped offers a generous free plan, making DMARC accessible for businesses of all sizes, from SMBs to large enterprises.
With Suped, you don't just get data, you get solutions. Our platform helps you transition to p=quarantine and ultimately p=reject confidently, ensuring your emails reach their intended recipients and your domain remains secure. Visit Suped.com to learn more.
Ensuring your emails reach their intended destination
The DMARC p=quarantine policy is a powerful tool for email security, directing unauthenticated emails to the spam or junk folder rather than directly to the inbox. While it offers robust protection against spoofing and phishing, it's essential to remember that the final delivery decision rests with the receiving mail server, influenced by a multitude of factors.
To effectively leverage p=quarantine and ensure legitimate emails reach their intended destination, continuous DMARC monitoring and careful analysis of reports are non-negotiable. Tools like Suped provide the visibility and actionable recommendations needed to navigate the complexities of email authentication, safeguarding your brand and improving your deliverability.
