DMARC p=quarantine Not Working?

DMARC p=quarantine doesn't stop phishing. Why not?

You set up DMARC with p=quarantine, expecting fewer phishing emails to reach your inbox. But the spam still comes through — some even pretending to be from your company. You're not imagining it. The policy isn’t failing. It’s just not designed to stop what it isn’t meant to stop.

DMARC isn't a spam filter. It doesn’t scan every message in the wild. It only acts on messages that claim to come from your domain. If the email sender isn’t using your domain, DMARC doesn’t touch it. Spammers know this — they send from domains they own, not from yours.

Key takeaways

DMARC p=quarantine only applies to emails that claim to be from your domain, not spoofed messages from unrelated domains.
Phishing attacks often originate from domains outside your organization; DMARC cannot block these unless the sender falsely claims your domain.
Spammers ignore DMARC policies entirely because they send from domains they control, not from domains they’re trying to impersonate.

What does p=quarantine actually do?

When you set DMARC's policy to p=quarantine, you're telling receiving mail servers to treat any email claiming to come from your domain that fails SPF or DKIM checks as suspicious—meaning it gets routed to the spam folder, not the inbox. It doesn’t block delivery outright, and it only applies to messages that violate your domain’s authentication rules. This reduces inbox placement for unauthorized senders, but doesn’t stop all spam or phishing, especially from sources that don’t care about DMARC.

How DMARC’s quarantine policy works in practice

Let’s say an attacker sends an email pretending to be from your domain. If your domain has a DMARC record with p=quarantine, and the message fails SPF or DKIM, a compliant email provider (like Gmail, Yahoo, or Outlook) will flag it as suspicious. The email might still arrive—but it lands in the spam folder, not the inbox. This reduces the chance of users seeing it, which helps protect your brand.

But here’s the catch: DMARC enforcement only affects servers that implement it. Not all email providers apply DMARC policies consistently. Some older or less strict systems may ignore your p=quarantine setting entirely. According to RFC 7483, DMARC is a voluntary policy—its effectiveness depends on adoption, not enforcement.

What p=quarantine does not do

It doesn’t stop phishing attacks outright. Attackers can still send emails using spoofed addresses that don’t match your domain, or use domains with no DMARC record. It also doesn’t detect malicious content—just authentication failure. And it doesn’t stop delivery; the message may still arrive, just with reduced visibility.

What’s more, if you’re sending legitimate mail and your setup isn’t properly configured—say, your SPF record is too restrictive or DKIM fails due to forwarding—you risk having your own messages quarantined. That’s why testing your DMARC policy is essential.

Using tools like MailTester’s inbox placement tester can help you verify how your authenticated emails appear in real inboxes across major providers. It gives you a clear picture of whether your DMARC policy is having the intended effect, without guesswork.

Why DMARC alone fails to stop phishing attacks

DMARC only protects your domain's name. It doesn't stop phishing emails sent from domains you don't own, nor does it block messages that don’t claim to come from your domain. Most attacks exploit weak authentication on third-party domains, so a p=quarantine policy has no effect on those. You can have perfect DMARC and still receive phishing attempts targeting your brand — just not from your domain.

Phishing targets domains you don’t own

Let’s be clear: DMARC applies only to messages claiming to come from your domain. Most phishing attacks aren’t sent from your domain at all — they spoof names like "paypal-login.com" or "secure-gmail.net," domains that aren’t yours, and therefore aren’t covered by your policy. According to the Anti-Phishing Working Group (APWG), over 70% of phishing campaigns in 2023 used domains not previously associated with the targeted brand.

Even if your DMARC policy is set to quarantine, it cannot block emails from domains that don’t claim to be from your domain. Attackers exploit this gap by sending messages from domains with no SPF, DKIM, or DMARC records — which are commonly seen in newly registered domains and phishing kits. Your policy simply doesn’t apply where it matters most.

No enforcement on non-spoofed domains

There’s no mechanism built into email standards to block a message just because it claims to be from "your brand" but isn’t. DMARC only applies if a sender claims to be sending from your domain and fails the authentication check. If the email says it’s from "[email protected]" — but it really isn’t — DMARC will catch it. But if the attacker uses "[email protected]" or "secure-paypal-login.org," DMARC has no influence.

Think of it like a security checkpoint: DMARC only checks the ID badge of someone claiming to be from your company. It doesn’t stop strangers from wearing fake uniforms or using fake names. Even with p=quarantine, you’re still exposed to social engineering and deception — especially when users are tricked into clicking links from domains that look similar but aren’t your own.

If you're still seeing phishing attempts despite having DMARC set to quarantine, that’s expected. The policy doesn’t protect against the broader attack surface. You need additional defenses: user training, email filtering at the gateway, and proactive monitoring of impersonation campaigns. The good news? Tools like inbox placement testing can help you see how your legitimate emails are being treated — and help avoid unintended side effects from overly strict policies.

The real threat: impersonation, not delivery

You’re running DMARC with p=quarantine because you want to stop phishing—good instinct. But DMARC doesn’t stop the real danger: a single deceptive email that looks like it comes from your CEO, sent to a single employee, that tricks them into giving up their password. No volume needed. Just one success. DMARC only checks technical authentication—email headers, DNS records—but not the message content, tone, or intent. A well-crafted phishing email can pass all technical checks and still be a threat. That’s why high-volume spam gets reduced, but targeted attacks still slip through.

Let’s be clear: DMARC’s quarantine policy is great for blocking forged bulk mail from outside your domain. It stops automated attacks, reduces inbox clutter, and helps keep your reputation clean. But here’s the gap: attackers don’t need volume. They need believability. A single email that mimics your legal team asking for an urgent wire transfer will bypass SPF, DKIM, and DMARC if the sender claims to be on your domain—because it is technically correct in the headers. What it fails to stop is the psychological trick.

CISA’s 2023 phishing reports show that nearly 90% of phishing campaigns begin with a single, well-crafted message—not 10,000 spam blasts. The real cost isn’t in delivery volume. It’s in trust exploitation.

Technical checks vs. real-world risks

DMARC only enforces technical authenticity. It tells servers: “If this email claims to be from your domain, make sure it meets the rules.” But it says nothing about whether the message should be trusted. A sender can use a legitimate domain, follow all protocols, and still be a phishing actor. If you’re relying solely on DMARC, you’re defending the wrong layer—the delivery system—not the human receiving the email.

That’s where tools like bulk email verification help. They don’t stop phishing directly, but they catch invalid or risky addresses before they’re even sent. If you’re cleaning your list and finding 15% of your “valid” emails are either disposable, role-based, or unverifiable, you’re reducing the attack surface before phishing even becomes possible.

Ultimately, DMARC protects domains from forgery—but it can’t prevent someone from reading an email and thinking, “This looks real.” That’s why a layered defense matters: technical policies like DMARC, combined with list hygiene and real-time inbox testing, together reduce the odds of a breach far more than any single control ever could.

DMARC policies don't catch all failed messages

Setting DMARC to p=quarantine doesn't stop all spam or phishing because it only acts on messages that fail SPF or DKIM authentication. If your own legitimate emails fail due to misconfigured records, they’ll be quarantined too — which harms deliverability and can make your domain appear unreliable. Some phishing attempts avoid authentication entirely, so DMARC won’t block them unless they also fail SPF or DKIM.

Authentication fails even when you’re not at fault

Let’s say you use a third-party platform like Mailchimp or HubSpot to send newsletters. If their sending infrastructure doesn’t align with your SPF or DKIM setup, the messages will fail authentication — even though they’re legitimate. That means your customers’ inboxes might receive quarantined messages, or worse, miss your email entirely.

DKIM signing can be inconsistent across senders. If one server signs a message and another doesn’t, the result is an authentication failure. Likewise, SPF records can include expired or incorrect entries — like old IP addresses or deprecated domains. These errors don't just weaken your policy; they can cause legitimate mail to be blocked or marked as spam.

False positives hurt engagement and reputation

When your DMARC policy quarantines emails that should be delivered, you get higher bounce rates. This doesn't just affect the sender — it can hurt your sender reputation over time. ISPs and email providers track complaint rates, bounce behavior, and engagement. A sudden spike in bounces from your domain may trigger red flags, even if those bounces come from misaligned third-party senders.

According to the DMARC specification (RFC 7483), enforcement relies on correct SPF and DKIM alignment. But misalignment is common — especially across complex email ecosystems. You can’t rely on DMARC alone to protect your inbox. It’s a safeguard, not a standalone prevention tool.

Fixing this starts with validating your email addresses before sending. Tools like MailTester’s email checker help verify whether an address is likely to be delivered, while bulk verification ensures your lists don’t contain stale, invalid, or non-receiving addresses. Keeping your sending base clean reduces the risk of authentication failure and prevents false positives that degrade your domain’s reputation.

How email verification helps fix the root causes

You’re not seeing fewer spam or phishing attempts because DMARC p=quarantine only applies to emails sent from your domain, not to the list you’re sending to. If your list includes invalid, catch-all, disposable, or role-based addresses, you’re still triggering filters, harming sender reputation, and increasing the risk of abuse—even if your own messages are compliant. Cleaning your list with email verification stops this before it starts.

Stop sending to invalid or non-existent addresses

MailTester checks if an email address actually exists and can receive messages—no guesswork. This prevents bounces that hurt your sender reputation over time.
High bounce rates, even from a few invalid addresses, degrade your sender score. Studies show ISPs penalize senders with 1%+ bounce rates consistently. You can avoid this with real-time verification.
Use MailTester’s email checker to validate single addresses before adding them to campaigns.

Remove high-risk addresses before they cause damage

Catch-all domains accept all emails—even ones they never intended to receive. Sending to these triggers spam traps and can result in being blocked by spam filters. MailTester identifies catch-all domains so you can exclude them.
Role accounts like info@, admin@, or sales@ rarely engage and often bounce. They’re commonly flagged by ESPs and can lower your inbox placement rate. MailTester detects these and marks them as risky.
Disposable email addresses (like mailinator.com) are used for abuse and spam. MailTester filters them out to safeguard your sending reputation. According to IANA, temporary email domains are frequently associated with automated signups and fraud.
Run your entire list through bulk email verification to uncover and remove these issues at scale.

Spam and phishing aren’t stopped by policy enforcement alone. They’re mitigated by not sending to addresses that can’t meaningfully engage or that attract abuse. Verification catches these issues before they affect delivery, reputation, or security.

Verify your list before sending to improve authentication hygiene

DMARC p=quarantine only works if your domain sends only from valid, authenticated addresses. If you’re sending to invalid or poorly maintained email addresses, you risk triggering spam filters, damaging your sender reputation, and undermining DMARC enforcement. Clean lists prevent failed deliveries, reduce complaints, and ensure that only properly authenticated messages are sent—cutting the noise that can weaken your domain’s trust signal.

Send only to known-valid addresses

When you send to addresses that don’t exist or are blocked, you generate bounces and complaints. Even a few bad sends can hurt your sender reputation over time. Using tools like bulk email verification lets you identify and remove invalid, catch-all, or disposable addresses before they ever leave your server. This reduces failed deliveries and keeps your sending behavior consistent with best practices.

You might think your list is clean, but domains change, roles expire, and inboxes get abandoned. Automated verification—especially with real-time checking against DNS, MX records, and SMTP servers—catches issues that manual review misses. A 98.9% accuracy rate, like MailTester’s, means you’re not relying on guesses. It’s about reducing the attack surface by only sending to verified inboxes.

Authentication hygiene starts with data quality

When every message originates from a known-valid address, it reinforces your domain’s authentication stack—SPF, DKIM, DMARC. If your list includes addresses that don’t respond to verification, you can’t guarantee those messages are properly authenticated during transit. That creates gaps that spammers exploit and filters flag.

Think of your send list as a supply chain: if the inputs are dirty, the outputs degrade. Poor sending behavior—delivered to invalid addresses, bounced, or marked as spam—can lead ISPs to treat your domain as a potential source of abuse. A cleaner list means fewer triggers for spam filters, even when DMARC policies are set to quarantine.

For example, RFC 7504 (which outlines DMARC reporting practices) emphasizes that consistent, honest sending behavior is key to building domain trust. This isn’t just about policy; it’s about execution. Verifying your email list before sending ensures your authentication framework isn’t undermined by bad data. That’s how you keep your domain from being labeled as high-risk by providers like Gmail or Outlook.

Use email verification tools to check individual addresses in real time or apply full list checks via API for high-volume sends. Either way, you’re not just cleaning your list—you’re hardening your domain’s defenses.

How to test delivery and inbox placement with real email checks

You can’t assume that a DMARC policy of p=quarantine is actually stopping spam or phishing if your legitimate messages aren’t landing in inboxes. The only way to know is to test delivery in real-world conditions using actual email inboxes across major providers—like Gmail, Outlook, Yahoo, and Apple Mail—as they receive your messages in real time. This reveals whether receivers are honoring your policy or ignoring it, which is critical for validating your email security posture.

Simulation, not just configuration

DMARC policies are set in DNS, but their effectiveness depends entirely on how mail receivers interpret and act on them. A policy might say “quarantine,” but if the receiving server doesn’t enforce it, your messages could still end up in spam folders or not arrive at all. MailTester’s inbox placement test uses actual inboxes from these providers to check what happens to your messages—whether they land in the inbox, get marked as spam, or are blocked entirely.

Unlike tools that only validate DNS or check syntax, this test simulates real-world delivery with no automation bias. You send a real test message from your domain, and the system records how each provider handles it—based on SPF, DKIM, and DMARC alignment. This gives you hard data: your policy is only as strong as the receivers’ willingness to follow it.

Check what’s really happening

Many organizations run DMARC with p=quarantine and assume it’s effective, only to find that bulk emails are still hitting spam folders or failing entirely. This often happens when receivers ignore policies due to misalignment, poor sender reputation, or lack of consistent enforcement. Testing with MailTester exposes these blind spots before they impact your deliverability or brand trust.

For example, if your outbound messages go to a high-volume sender (like a transactional or marketing email), the receiver might treat them as spam even if the policy matches—because of sender reputation or content signals. The test captures that failure mode, not just a DMARC “pass.” You can see whether your messages are being quarantined by Gmail or marked as spam by Yahoo—meaning your policy isn’t being enforced, or your domain isn’t trusted enough to bypass spam filters regardless of policy.

This kind of validation is an industry-standard method used by top enterprises to verify security and delivery performance. As outlined in RFC 7483, DMARC’s effectiveness depends on both policy enforcement and real-world execution. Tools that only check alignment or DNS are missing that layer of truth.

Use MailTester’s inbox placement test at https://mailtester.com/inbox-tester/ to run real-world checks across major providers and confirm whether your p=quarantine policy is actually working. Only then can you trust it to stop phishing or reduce spam in your domain’s inbound mail.

Integrating verification into your workflow

DMARC p=quarantine stops some spam, but it doesn’t stop bad emails from ever arriving. The real fix is cleaning your list before sending. Use MailTester to verify every address at capture and scrub old lists. That stops low-quality inboxes from dragging down your reputation and keeps your messages out of spam folders.

Start with real-time verification at point of capture

Integrate MailTester’s real-time API into your signup forms. As a user types their email, verify it instantly. This blocks typos, disposable addresses, and invalid formats before they enter your system.
Use the email checker to validate individual emails when you’re not processing hundreds. Ideal for one-off checks or debugging deliveries.
Let the API return a clear verdict: valid, invalid, catch-all, or risky. Act immediately—reject invalid or disposable addresses before storing them.

Run bulk verification and automate list hygiene

Run your existing email list through MailTester’s bulk verification tool. Identify and remove invalid, catch-all, and disposable addresses. This can reduce your list size by 10–30%—and that’s a good thing.
Integrate with platforms like Mailchimp, HubSpot, Klaviyo, or SendGrid. Each integration runs on a schedule or triggers on a list update. Clean the list before every campaign.
Use the results to update your sender reputation. Sending to fewer invalid addresses means fewer bounces, which improves deliverability. According to Spamhaus, consistent sender reputation signals are key to avoiding filtering.

Keep your list clean and your reputation strong. Every good email you send is one step toward better inbox placement. You’re not just reducing spam in your own inbox—you’re protecting your brand from being associated with poor senders. Start today with 100 free verifications.

DMARC is one layer. Your list hygiene is the foundation.

DMARC policies like p=quarantine only protect domains when emails come from legitimate sources. If your list contains invalid, outdated, or high-risk addresses, authentication fails by default.

High bounce rates, poor open rates, and frequent spam complaints degrade sender reputation. Even with strict DMARC enforcement, bad list hygiene triggers filters and lands emails in spam folders.

Authentication works best on clean, engaged lists. A p=quarantine policy doesn’t compensate for list decay. Verify your data before sending to maintain inbox placement and sender trust.

Sources

APWG observed 1,003,924 phishing attacks in Q1 2025 — the highest quarterly count recorded since late 2023. — APWG Phishing Activity Trends Report Q1 2025 (2025)
Gmail's filters stop more than 99.9% of spam, phishing, and malware, blocking nearly 15 billion unwanted emails every day. — Google (The Keyword blog) (2023)

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does DMARC stop spam emails?

No. DMARC only applies to emails claiming to be from your domain. Spam often comes from domains not owned by you.

Why do phishing attacks still work if I have DMARC p=quarantine?

Phishing attacks usually impersonate unrelated domains. DMARC does not cover those domains or spoofing attempts outside your control.

Can DMARC prevent my domain from being spoofed?

It reduces the chance of successful spoofing by enforcing authentication. But it does not stop attackers from using entirely different domains.

Does setting p=quarantine guarantee better inbox placement?

No. It only instructs receivers to treat failed messages as suspicious. Some providers ignore or bypass policies, especially if the sender has poor engagement history.

What happens if my SPF or DKIM records are wrong?

Legitimate emails may fail authentication and be quarantined. This harms deliverability and can damage your sender reputation.

How does email verification improve DMARC effectiveness?

Clean lists reduce bounces and complaints, improving sender reputation. This makes receiving providers more likely to enforce DMARC policies.

Can MailTester detect if an email is disposable?

Yes. MailTester's verification identifies disposable email domains — which are often used in spam and phishing campaigns.

Is email verification free with MailTester?

Yes. You get 100 free verifications to start, and purchased credits never expire.

How accurate is MailTester’s email verification?

MailTester delivers 98.9% accuracy, testing real email delivery behavior with live inboxes.

Can I use MailTester with SendGrid or Mailchimp?

Yes. MailTester integrates directly with SendGrid, Mailchimp, HubSpot, and Klaviyo for automated list cleaning.

What does a 'catch-all' email mean?

A catch-all address accepts all emails sent to any address on the domain. These are often used by spammers and are a risk to deliverability.

How often should I verify my email list?

Verify at capture and run bulk checks quarterly. High turnover or poor source quality demands frequent cleaning.