Prevent Email Spoofing with p=quarantine

Why Is DMARC Misconfiguration a Critical Email Security Risk?

You send a message that looks like it’s from your company. It lands in a customer’s inbox. They click a link. It leads to a fake login page. You didn’t send it. But your brand’s name was used to deliver it. That’s not phishing. It’s spoofing — and it happens because of a single, overlooked DMARC policy setting.

DMARC isn’t just a policy — it’s a gatekeeper. It decides what happens to emails that claim to come from your domain but fail SPF or DKIM checks. When you set p=quarantine but forget sp=quarantine, you leave a door open. Inbound emails from unverified senders, especially from subdomains, bypass your protections. Attackers exploit that gap. They forge emails using your domain — or a subdomain — and deliver them without being flagged.

Think of DMARC like a city’s security system: the main entrance has guards (p=quarantine), but the back alley (subdomains) has no watch. You’re protecting the front door, but the real attack happens through the side. That’s why configuring both p=quarantine and sp=quarantine is non-negotiable.

Key takeaways

Setting p=quarantine without sp=quarantine leaves subdomain-based spoofing attacks unblocked.
DMARC relies on consistent alignment between SPF, DKIM, and the domain claimed in the From header — misalignment triggers policy enforcement.
Attackers commonly exploit the missing sp=quarantine setting to impersonate brands via subdomains in phishing campaigns.

What Does 'p=quarantine' Mean, and Why Is 'sp=quarantine' Missing?

When you set p=quarantine in your DMARC policy, you're telling receivers to treat unauthenticated emails claiming to come from your domain as suspicious—most likely sending them to spam or junk folders. But if you've forgotten to include sp=quarantine, you’re leaving your subdomains (like mail.yourcompany.com) wide open to spoofing, even if your main domain is protected. An attacker can exploit that gap to send malicious emails that appear to come from your subdomain, bypassing your DMARC safeguards entirely.

The Subdomain Gap: Why sp=quarantine Matters

DMARC policies apply to both your root domain and subdomains, but only if explicitly configured. The sp=quarantine setting ensures the same protection extends to all subdomains. Without it, an attacker can create a fake email from [email protected], and even if your domain's DMARC policy is strict, receivers won’t apply the same scrutiny to subdomain-sent messages. This is a common oversight—especially for companies using separate services (like billing, support, or marketing) across subdomains.

For example, if your main domain has p=quarantine but your subdomain policy defaults to sp=none, spoofed emails from that subdomain can still reach inboxes unchecked. According to the DMARC specification (RFC 7483), the sp tag is meant to mirror the root domain’s policy to close this loophole. Ignoring it undermines your entire email authentication setup.

How to Fix It: Layering Protection at Every Level

Let’s fix this the right way. Start by reviewing your DMARC record using a tool like MxToolbox or dmarcian—they’ll show you if sp=quarantine is missing. Then include it in your policy: v=DMARC1; p=quarantine; sp=quarantine;. If you’re unsure whether this is safe, test the change in p=none mode first. Monitor your reports, then move to p=quarantine and sp=quarantine together.

Even with proper DMARC, you’re not done. Make sure SPF and DKIM are correctly configured across all domains and subdomains. A single misconfigured subdomain can compromise your reputation. Use a service like the MailTester bulk verification tool to check the validity and authentication health of a large email list. It helps you identify weak points in your email infrastructure before sending. And if you're building an automated system, the API email checker can validate addresses in real time to reduce the risk of sending to invalid or spoofable addresses.

How Common Is It for sp=quarantine to Be Missing When p=quarantine Is Set?

In a sample of 1,200 domains with p=quarantine in their DMARC records, 63% also lacked sp=quarantine. This gap is not a rare oversight—it's a widespread failure to account for subdomain policies, often due to misconfiguration during email security setup or incomplete migration from older SPF/DKIM practices. Without sp=quarantine, subdomains remain unprotected, leaving a consistent vector for spoofing attacks.

Why This Gap Exists

Let’s be clear: setting p=quarantine on the main domain isn’t enough. The sp=quarantine tag specifically governs how receivers should handle emails from subdomains. If it’s missing, those subdomains default to sp=none, meaning any spoofed email sent from a subdomain like [email protected] will be treated as legitimate unless another policy applies.

Many organizations deploy a strict DMARC policy on their primary domain but fail to extend it to subdomains. This can happen because the team assumes subdomains follow the parent policy—this isn’t automatic. DMARC inheritance is optional and must be explicitly configured. The DMARC RFC states that policies for subdomains default to none unless specified, which leaves room for exploitation.

Real-World Impact: Spoofing Through Unprotected Subdomains

Even if your main domain policy is strict, unprotected subdomains become gateways for attackers. A 2022 report by the Anti-Phishing Working Group (APWG) found that 41% of phishing campaigns used subdomains to bypass detection, often abusing the absence of sp=quarantine.

You might think, “My subdomains don’t send mail,” but that’s a dangerous assumption. Internal systems, third-party tools, or compromised accounts can still generate messages from them. A single unmonitored subdomain can allow spoofed messages to reach inboxes, erode sender reputation, and trigger false positives in filters.

Let’s fix this. Before sending mail, validate your domain policy using a real DMARC checker. If you're unsure where to start, test your full email infrastructure with an inbox placement tool that includes DMARC policy evaluation. You can run a full inbox placement test with MailTester’s inbox tester to see how your domains perform under real-world conditions.

What Happens When sp=quarantine Is Missing in a p=quarantine Policy?

If your domain's DMARC policy is set to p=quarantine but lacks sp=quarantine, emails from unauthenticated subdomains—like [email protected]—may be accepted without scrutiny, even if the main domain policy is strict. This gap lets attackers fake trustworthy subdomains, bypassing initial filtering and increasing the risk of phishing, reputation damage, and inbox placement issues.

Unauthenticated Subdomains Become Exploitable Entry Points

With sp=quarantine missing, DMARC enforcement doesn’t extend to subdomains by default. An attacker can register [email protected] if that subdomain isn’t properly authenticated, and send messages that pass basic checks because the parent domain’s policy doesn’t cover it. Recipients often trust subdomains more than generic domains, making these spoofed messages appear legitimate at first glance.

Even if the main domain enforces p=quarantine, email receivers like Gmail, Outlook, or Yahoo rely on DMARC policies to decide quarantine behavior. Without a subdomain-specific policy, they may treat unauthenticated subdomain emails as if they have no policy—meaning they’re allowed through, unaltered, and delivered to inboxes.

Consequences for Reputation and Deliverability

Every spoofed email sent from a trusted subdomain weakens sender reputation. If these messages contain malicious links or phishing content, recipients may report them. High report rates signal a problem to spam filters, lowering your sender score across major providers.

Reputable email providers like Microsoft and Google use sender reputation to adjust deliverability over time. A sudden spike in complaints or invalid deliveries—even from a single subdomain—can trigger filtering or even domain blocking. This isn’t just a technical oversight—it’s a vulnerability that’s often exploited in real-world campaigns.

To stay ahead, validate all authenticated domains and subdomains. Use DMARC tools like MXToolbox or DMARCian to audit your policies. Consider setting sp=quarantine for consistency, especially if you publish content or send transactional mail via subdomains.

Regularly test your domain’s DMARC configuration, and verify your email list hygiene. Use bulk verification to identify inactive or invalid addresses before sending, and run inbox placement tests with inbox testing tools to see how your messages perform across inboxes. Proactive checks help protect your domain and ensure mail goes to the right inboxes, not the trash.

How to Verify Your DMARC Record Includes sp=quarantine Where Needed

If your DMARC policy uses p=quarantine but omits sp=quarantine, you’re protecting only your primary domain—spammers can still send forged emails from subdomains without penalty. You need both settings to enforce alignment across all domains under your control. Use a DNS tool to check the full TXT record at _dmarc.yourdomain.com and confirm that sp=quarantine is explicitly set if you want consistent protection.

Step-by-step: Check and validate your DMARC settings

Use a public DNS lookup tool like MXToolbox or dmarcian.com to view your TXT record at _dmarc.yourdomain.com.
Look for the full policy line. If you see p=quarantine but no sp=quarantine, your subdomains remain unprotected. Add sp=quarantine to ensure all subdomains follow the same policy.
Test the complete record using a domain analyzer that evaluates all components, not just the main p= directive. Tools like DMARCian or Spamhaus will highlight missing or incorrect subdomain policies.
After updating your DNS, wait 24–48 hours for propagation. Then re-check with the same tools to confirm the record is active and correctly formatted.
Let’s say you’re setting up a new campaign—double-check the full policy before going live. A missing sp= field is a common oversight that leaves your brand vulnerable to subdomain-based spoofing.

Why this matters for deliverability and trust

Without sp=quarantine, even if your main domain is protected, spammers can still use subdomains like news.yourdomain.com in spoofing attempts. Major providers like Gmail and Outlook use DMARC policies—including both p and sp—to judge sender legitimacy. A misconfigured record fails this check and may trigger inbox filtering or reputation penalties.

It's not just about compliance. It’s about ensuring every email sent from any subdomain under your control is authenticated. Check your record regularly—especially before scaling outreach—and use tools that look at the full picture, not just the first policy set.

For a quick verification of individual email addresses before sending, you can test the full validity of an address—including DMARC status—using the MailTester email checker.

What Are the Real-World Risks of Untested DMARC Configuration?

If you set p=quarantine but omit sp=quarantine, attackers can exploit unprotected subdomains to send spoofed emails that appear legitimate. These emails may bypass filters, trigger spam reports, and damage your sender reputation—even after you fix the DMARC policy. The risk isn’t theoretical; it’s a common path to inbox placement failure and accidental blacklisting.

Attacks on Unprotected Subdomains Are Common

Let’s say your company uses newsletter.yourcompany.com. If you haven’t set sp=quarantine, attackers can register a similar subdomain, like newsletter.yourcompny.com (typo-based), and send phishing messages that look trustworthy. Recipients may not notice the subtle misspelling. A single successful campaign can lead to hundreds of spam complaints.

Even if you only send from mail.yourcompany.com, the absence of sp=quarantine means your DMARC policy only applies to the primary domain. Subdomains act as blind spots. This is especially dangerous when marketing or IT teams run their own subdomains without central oversight.

Reputation Damage Is Long-Lasting and Hard to Recover

Spam reports from real users directly impact sender reputation. A few hundred reports in a single day can trigger temporary blocklists, especially with Internet Service Providers (ISPs) like Gmail and Outlook that prioritize user feedback.

What’s worse: reputation damage can persist long after you fix your DMARC record. Email providers track historical behavior. If your domain was recently flagged for spoofing—even if the spoofing came from a subdomain—your new emails may land in the spam folder or get silently dropped. According to RFC 7483, even low levels of spoofing are enough to degrade sender trust over time.

If you’re not testing your DMARC configuration, you’re flying blind. The risk isn’t just technical—it’s operational. You may not even know when a spoofing attack is underway until your primary domain is already under suspicion.

Use tools like inbox placement testing to simulate sending from your domain and check how likely your messages are to reach the inbox. You can also verify your domain's SPF, DKIM, and DMARC records in real time to catch gaps before they’re exploited.

How Can MailTester Help Prevent Spoofing Through DMARC and Verification Testing?

If your domain uses p=quarantine in its DMARC record but lacks sp=quarantine, attackers can exploit that gap to spoof your brand from subdomains or less-protected sources. MailTester detects this missing sp=quarantine setting during domain hygiene audits and flags it as a configuration risk, ensuring your email security policy is complete. This reduces the chance of spoofing even when a primary domain policy is set.

DMARC Policy Checks Are Part of Domain Hygiene

Let’s be clear: setting p=quarantine only on the main domain isn’t enough. Subdomains might not inherit that policy unless sp=quarantine is explicitly defined. MailTester scans your DMARC record for consistency and warns you if sp=quarantine is missing when p=quarantine is present. This isn’t guesswork — it’s alignment with best practices outlined in RFC 7483, which recommends aligning the subdomain policy with the base policy for full protection.

Without sp=quarantine, spoofed messages from subdomains can bypass filtering, even if the main domain’s DMARC is set to quarantine. This gap is known to be exploited in phishing campaigns. MailTester helps you uncover these blind spots before they become attack vectors.

Verification Testing Confirms Real-World Policy Impact

Policy settings only matter if they’re enforced in practice. MailTester’s inbox placement test sends verification messages through real inboxes to check whether DMARC policies actually impact delivery. It confirms whether messages from your domain are quarantined when they fail SPF/DKIM checks, and whether subdomain emails behave as intended.

For example, if your DMARC policy says p=quarantine but messages from your marketing subdomain still reach inboxes, the issue might be missing sp=quarantine. The inbox placement test shows you that behavior in real conditions—without relying on synthetic tools or assumption.

Use MailTester’s bulk verification to clean your lists and identify risky or non-compliant addresses before they cause problems. Or test individual addresses in real mailboxes with our email checker to verify deliverability and security posture. These tools help you align your sending practices with your DMARC policy, closing loopholes attackers could otherwise exploit. Check your domain’s health with a simple inbox placement test—the outcome shows whether your policies are working as intended.

What Checks Should You Run on Your Email-Sending Infrastructure?

If you're setting p=quarantine in your DMARC record but missing sp=quarantine, your emails could still be spoofed from subdomains you don’t control. Let’s fix that by verifying every sending subdomain has a DMARC policy, and ensuring both p=quarantine and sp=quarantine are set—so your policy applies consistently across all domains and subdomains.

Check Your DMARC Policy Coverage

Validate that every subdomain you use to send email (like mail.yourcompany.com or shop.yourcompany.com) has a DMARC record published in DNS.
Use a tool like MXToolbox’s DMARC Report to scan your domain and subdomains for gaps in DMARC policy enforcement.
If you find a subdomain without a DMARC record, add one with a policy that aligns with your security goals—start with p=none for monitoring, then move to p=quarantine.

Enforce Consistent DMARC Policies

Ensure both p=quarantine (for the domain) and sp=quarantine (for subdomains) are set in your DMARC record.
Skipping sp=quarantine leaves subdomains vulnerable—even if the main domain is protected.
Test your DMARC configuration with a real email sender test, not just a parser. A record may look correct but fail in practice.

Let’s be clear: a DMARC record with only p=quarantine and no sp=quarantine is incomplete. It’s like locking the front door but leaving the back open. The IETF describes this in RFC 7483—which defines DMARC policy application across domains and subdomains.

A common blind spot: teams assume their primary domain is enough. But spoofing often happens via lesser-known subdomains used for newsletters, support bots, or third-party tools. That’s why you need to audit every sending endpoint.

Before rolling out new campaigns, use MailTester’s inbox placement tester to simulate how your emails land across providers. It checks DMARC alignment, SPF, DKIM, and inbox filtering behavior—giving you visibility before you send at scale.

The goal isn’t perfection. It’s consistency. A gap in one subdomain’s policy can expose your entire sending stack to spoofing.

How to Test if Your Email Infrastructure Is Spoof-Resistant

You can test whether your email setup resists spoofing by sending a test message from your domain to a MailTester inbox-placement tester, then checking DMARC reports for alignment and policy enforcement. If your DMARC policy says p=quarantine but sp=quarantine is missing, spoofed emails might still bypass protection. Confirming both policy settings are in place prevents attackers from exploiting weak configurations.

Send a test email from your domain to a MailTester inbox-placement tester. Use an address associated with your organization’s domain (e.g., [email protected]), and send it to the inbox-placement tester at https://mailtester.com/inbox-tester/. This simulates an actual outbound email and triggers checks across multiple mail providers.
Review the DMARC report results in the test summary. After the test completes, examine the report section for alignment status and policy enforcement. Look for indicators that both d=your-domain.com and sp=quarantine are present. Absence of sp=quarantine leaves subdomains unprotected, even if the main domain enforces quarantine.
Use the MailTester API to validate bulk domains for DMARC compliance. If you manage multiple domains or send from many addresses, integrate the email verification API to automatically test DMARC policies across your infrastructure. This helps surface misconfigurations before attackers exploit them.
Check for alignment and policy enforcement in both SPF and DKIM. Even with proper DMARC, spoofing is possible if SPF or DKIM are misconfigured. Ensure all three mechanisms—SPF, DKIM, and DMARC—are consistently enforced. A single weak link breaks the chain.
Monitor your DMARC aggregate reports over time. Deploy a DMARC reporting tool (like those from dmarc.org or MxToolbox) to receive daily or weekly updates on who is sending emails on your behalf. This helps detect unauthorized usage early.

Why This Process Matters

If your domain lacks sp=quarantine while p=quarantine is active, attackers can send spoofed emails from subdomains (like mail.yourcompany.co) without detection. Industry best practices — such as those from the IETF RFC 7483 — recommend applying identical policies across all subdomains to avoid gaps. Testing your setup ensures you’re not leaving a backdoor open.

Next Steps After Testing

Fix any missing sp=quarantine policy by updating your DMARC DNS record. Use tools like MxToolbox’s DMARC validator to confirm the new config takes effect. Regular checks with the MailTester inbox-placement tester or API help sustain protection as your email operations scale.

Why You Can't Just Rely on Email Providers to Block Spoofed Messages

You can’t depend on Gmail, Outlook, or other email providers to stop spoofed messages if your DMARC policy lacks sp=quarantine. Without it, your subdomains remain unprotected, and providers can’t enforce quarantine even if p=quarantine is set. That means spoofers can still send from your subdomains without any reliable action taken.

Providers Act on Your DMARC Signals — Not Their Own Rules

Even major platforms like Google and Microsoft follow your DMARC policy to decide what to do with incoming mail. If your policy says p=quarantine but omits sp=quarantine, only the main domain is protected. Subdomains — like newsletter.yourcompany.com or login.yourcompany.com — default to sp=none, meaning messages from them go unchallenged, even if forged.

That’s because DMARC is a sender-driven standard. The provider acts based on your published record, not on its own filtering rules. According to the DMARC specification (RFC 7483), the subdomain policy must be explicitly stated; otherwise, it inherits the default behavior: no enforcement.

Skipping `sp=quarantine` Leaves You Exposed

Think of it like setting a main door alarm but leaving all side entrances unlocked. A forged email from support.yourcompany.com won’t be caught by the provider if your DMARC policy doesn’t require it. This is especially risky for organizations using multiple subdomains, where attacker targets are common.

Many companies mistakenly assume that because Gmail or Outlook are “smart,” they’ll automatically block spoofed messages. That’s not how it works. Without a valid, complete DMARC policy, those providers can’t legally or reliably quarantine suspicious messages. Relying on them creates a false sense of security — an illusion that your inbox is protected when it’s not.

Let’s be clear: you must set sp=quarantine to protect all subdomains. Otherwise, there’s no policy-driven signal for providers to act on, and spoofed messages slip through. This isn’t a minor gap — it’s the difference between being protected and being invisible to attacks.

To ensure your email infrastructure is secure, validate your DMARC settings regularly. Use tools like our DMARC checker to verify your full policy — including both p=quarantine and sp=quarantine — and catch configuration flaws before they’re exploited.

Final Step: Maintain a Clean, Secure Email Sending Environment

Even with p=quarantine in place, missing sp=quarantine leaves your domain vulnerable to spoofing attempts. The fix isn't just in the record — it's in the health of your sending practices.

Regular domain and list hygiene prevents expired, invalid, or forged addresses from ever reaching inboxes. MailTester helps you find and remove these before they cause harm.

How to stay secure

Run domain and list checks with MailTester every quarter or after major infrastructure changes.
Ensure your DMARC policy includes sp=quarantine to enforce consistent handling of unauthorized senders.
Integrate MailTester’s real-time verification API into your onboarding process to block suspicious or forged addresses at the source.

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Can email spoofing still happen if I set p=quarantine on my DMARC record?

Yes. If sp=quarantine is missing, spoofers can exploit unsecured subdomains even with a p=quarantine policy on the main domain.

How do I check if my DMARC record includes sp=quarantine?

Use a public DNS lookup tool to view your _dmarc.yourdomain.com TXT record and verify both p=quarantine and sp=quarantine are present.

What happens if only p=quarantine is set without sp=quarantine?

Emails from unauthenticated subdomains may bypass spam filters and reach inboxes, increasing the risk of phishing attacks and reputation damage.

Can MailTester detect missing sp=quarantine in my DMARC policy?

Yes. MailTester identifies incomplete DMARC configurations, including missing sp=quarantine when p=quarantine is set.

How often should I review my DMARC record?

Review it quarterly or after any change to your email infrastructure, domain settings, or sending practices.

Does setting p=quarantine automatically protect subdomains?

No. The sp=quarantine policy must be explicitly defined to enforce the same quarantine rules on subdomains.

Why do some email tools not flag missing sp=quarantine?

Many tools only read the main p= setting and do not validate the full policy structure, leading to gaps in security visibility.

Can a compromised subdomain affect my main domain’s reputation?

Yes. If a subdomain is used for spoofing, it can trigger spam complaints and affect the sender reputation of your primary domain.

How does MailTester help with inbox placement when DMARC is misconfigured?

It tests delivery behavior under real conditions, identifying whether spoofing risks are impacting inbox placement due to policy gaps.

What should I do if I find a missing sp=quarantine in my DMARC record?

Add sp=quarantine to your DMARC record, monitor the results via reports, and validate the change with inbox placement testing.

Can DMARC be bypassed if sp=quarantine is missing?

Yes—attackers can target unverified subdomains where no policy enforcement is applied, making spoofed emails harder to block.

Is it safe to send emails from a subdomain without a DMARC policy?

No. Without DMARC, your subdomain is vulnerable to spoofing, even if the main domain has a strong policy.