DMARC Quarantine vs Reject: How to Move Beyond Monitoring Safely

Quarantine and reject ask for different treatment

DMARC quarantine asks receiving mail systems to treat failing messages as suspicious, often placing them in spam. DMARC reject asks them to reject those messages. The policy applies to mail that fails DMARC checks for your sending domain. Receivers can apply their own rules, so neither setting is a universal delivery guarantee.

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, connects email authentication to the domain people see in the From address. Before changing enforcement, identify every legitimate service sending mail on behalf of that domain. The forgotten sender is often a helpdesk, invoicing platform or marketing tool.

DMARC none vs quarantine vs reject

Monitoring can still be useful, but leaving a domain at p=none does not request enforcement against unauthenticated impersonation. Equally, jumping to reject before checking your own mail can create a business problem. Choose the next step from evidence rather than a scanner's green tick.

An SPF or DKIM pass also needs alignment

A sender can pass an authentication check while using a domain unrelated to the visible From address. DMARC needs a passing SPF or DKIM result with the appropriate domain alignment. It does not require both mechanisms to pass, although maintaining both correctly is useful. Strict and relaxed alignment modes have different matching rules.

For example, an invoicing service may send from billing@your-business.example but sign messages using its own domain. You need to check whether that service supports a correctly aligned configuration. Follow the platform's current instructions for custom DKIM and sending-domain setup. Publishing an SPF record alone does not prove that the entire mail path passes DMARC.

Find legitimate senders before changing the record

• List the primary mail service and every other approved sender.
• Include invoices, newsletters, website notifications, ticket replies and application alerts.
• Record a business owner and technical contact for each service.
• Inspect representative message headers and DMARC reports.
• Resolve failed or unaligned authentication for legitimate senders.
• Check subdomain use and the intended policy for those domains.

Reports help you find patterns, but they need interpretation. An unfamiliar sending system may be abuse, a supplier you forgot to list or a mail path affected by forwarding. Do not authorise an unknown service simply to reduce the failure count. Compare the report with your approved sender inventory and real message headers.

Use a staged rollout with an owner and rollback plan

Start by fixing the legitimate senders while monitoring. Then agree a change window, test the important mail journeys and move towards enforcement. Where appropriate, a pilot domain or a limited, well-understood mail stream can help expose delivery issues before a broader change. The current features and rollout controls supported by your mail platform should determine the exact method.

Write down the existing DNS record, the proposed change, who can approve it and how the team will detect a delivery problem. Keep monitoring after enforcement. A new marketing platform added next quarter needs the same authentication review as the mail services you have today.

Know what DMARC does not protect

DMARC helps with unauthorised use of your domain in email. It does not establish that the person controlling a mailbox is trustworthy, and a lookalike domain can have its own valid authentication. A compromised account may send authenticated mail. Keep sign-in protection, mailbox monitoring, filtering and independent payment verification in the wider plan.

Our Google Workspace security checklist and Microsoft 365 security checklist cover the surrounding controls. For the payment process, read invoice fraud prevention. BPro can review your mail platform, approved senders and the technical work needed for a scoped email-security change.