How to Fix DMARC Quarantine

5,000 messages a day to Gmail is Google's threshold for bulk senders in its 2024 sender requirements, and DMARC is now part of the baseline for operating at that volume. That matters because a domain set to p=quarantine will expose every alignment mistake across marketing, lifecycle, sales, support, and transactional mail.

If legitimate mail is being quarantined, the fix is usually not to remove DMARC. The real job is to find which stream fails alignment, why the receiver is honoring quarantine, and how to correct the sender setup without weakening the rest of your protection.

What DMARC quarantine actually means

A DMARC policy of p=quarantine tells receiving systems that mail failing DMARC should be treated as suspicious. In practice, Gmail may place it in spam, Outlook may route it to Junk or filter it more aggressively, Yahoo may bulk it, and Apple Mail may simply display whatever the receiving server already decided upstream.

The important detail is that DMARC is not asking whether SPF or DKIM passed in isolation. It is asking whether at least one of them passed and aligned with the domain in the visible From address. A message can show spf=pass and dkim=pass in the header, then still fail DMARC because both passed on the wrong domain.

Find the failure before you change policy

Start with DMARC aggregate reports

Aggregate reports tell you which source IPs are sending as your domain, how much volume they represent, and whether SPF or DKIM aligned. If one ESP, CRM, or support platform accounts for most failures, that stream usually becomes the first fix because it gives you the biggest reduction in quarantined mail fastest.

Focus on three fields first: the source sending the mail, the Header From domain, and whether SPF or DKIM aligned. If a source is unfamiliar, treat it as either an untracked third-party sender or unauthorized traffic until you verify ownership with your RevOps, lifecycle, and IT teams.

Check one quarantined message header

Then inspect the headers of an actual message that landed in spam or junk. In Authentication-Results, look for the outcome of SPF, DKIM, and DMARC. A common pattern looks like this in plain English: SPF passed for a vendor bounce domain, DKIM passed for a vendor signing domain, but neither matched the visible From domain your recipient saw, so DMARC failed and quarantine was applied.

Fix the three most common root causes

1. SPF passes but is not aligned

This is one of the most common reasons legitimate mail gets quarantined. The platform sends from your visible From address, but the envelope sender, also called the return-path or bounce domain, remains on the vendor's domain. SPF can pass for that vendor domain and still fail DMARC alignment.

The fix is to configure a custom MAIL FROM, return-path, or bounce domain on the sender so the SPF-authenticated domain aligns with your From domain. While reviewing SPF, remember the protocol has a practical limit of 10 DNS lookups. If your record is bloated with includes, flattening or streamlining it may be necessary before alignment changes become reliable.

2. DKIM passes but uses the wrong signing domain

DKIM is often the cleaner fix because it survives forwarding better than SPF when the message body and headers remain intact. But for DMARC to pass, the d= signing domain needs to align with the visible From domain, either exactly in strict mode or at the organizational level in relaxed mode.

If your sender signs as vendor.example.net while your From address is yourbrand.com, DMARC will still fail. The remedy is usually enabling custom DKIM inside the platform so mail is signed as yourbrand.com or an aligned subdomain such as mail.yourbrand.com.

3. A third-party sender is using your domain without full authentication

This happens all the time in mature stacks. Marketing is authenticated, but the support desk, survey tool, invoicing platform, webinar app, or outbound sales system is not. The result is uneven behavior where Gmail quarantines one stream, Outlook junk-filters another, and Yahoo delivers a third inconsistently.

Build a sender inventory by function, not just by vendor. List lifecycle automation, newsletters, billing, receipts, support replies, recruiting, product notifications, and sales engagement separately. Then confirm each source has aligned SPF or DKIM, preferably DKIM, before it sends at scale.

Review the DMARC record itself

Sometimes the quarantine problem is not with the sending stream, but with the DMARC record design. A quick record review often reveals why legitimate mail is being treated more aggressively than the team expected.

Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

Tags worth checking first

• p=quarantine, confirms the policy mailbox providers should apply to the root domain.
• pct=100, means the policy is intended for all failing mail. If you are actively remediating, reducing percentage can limit impact while fixes roll out.
• adkim=s or aspf=s, strict alignment can break streams that would pass under relaxed alignment.
• sp=quarantine or sp=reject, this applies policy to subdomains and can surprise teams sending from delegated subdomains.
• Multiple DMARC records, receivers can treat that as invalid, which creates inconsistent enforcement and analysis.

If you inherited the record, check whether strict alignment was enabled intentionally. Many programs can operate safely with relaxed alignment while teams standardize vendor setup. Relaxed does not mean careless, it means the authenticated domain can be an aligned subdomain instead of an exact string match.

Handle forwarding and mailing-list edge cases

If DMARC failures are concentrated in replies, forwarded messages, or community sends, the problem may be path-related instead of sender-related. SPF commonly fails after forwarding because the forwarder is not authorized in your SPF record. DKIM is meant to carry the message through that change, but it only helps if the signature survives.

Mailing lists can also modify the subject line, append footers, or rewrap content, which can break DKIM. When that happens, forwarded or list traffic may be quarantined even though the original sender configuration was correct. In these cases, preserving DKIM alignment is usually more durable than trying to make SPF cover every transit path.

This is also why one recipient can report a problem in Apple Mail while another sees nothing unusual in Gmail. The mailbox provider made the filtering decision, the mail client simply displays the result.

Roll out the fix without losing control

Once you know which streams are failing, prioritize by recipient volume and business criticality. Transactional receipts, password resets, and support replies usually come before low-value campaign traffic because the risk of user impact is higher.

If you need breathing room, you have two controlled options. You can keep p=quarantine and temporarily lower pct while fixes are deployed, or you can move to p=none briefly to collect clean reporting without enforcement. The better choice depends on how much bad mail you are already blocking and how quickly the sending teams can remediate. Quarantine is often worth keeping for most of the domain if only one or two tools are the problem.

After remediation, watch results by mailbox provider. Gmail, Outlook, and Yahoo do not always respond on the same timeline, and changes can take a little while to stabilize as new messages are evaluated. Return to full percentage once aligned traffic is consistently passing.

Related reading: how does dmarc work and dmarc reports explained.

Run your first deliverability test with Mailora, and see which authentication signals still need attention.

FAQs

Should I change DMARC from quarantine to none to fix the problem?

Only if you need a short diagnostic window. In many cases, it is better to keep quarantine in place and fix the sender that is failing alignment, especially if most of your mail is already passing.

How long does it take for DMARC quarantine issues to improve after a fix?

Header-level fixes apply immediately to newly sent mail, but inbox behavior can take longer to normalize because each provider evaluates fresh traffic over time.

Can SPF alone fix DMARC quarantine?

Yes, if SPF passes and aligns with the visible From domain. In practice, DKIM is often the more stable path because it survives forwarding better.

Why does Gmail quarantine a message that Outlook delivers?

Each mailbox provider weighs authentication and reputation differently. DMARC policy is shared, but enforcement and placement decisions are still provider-specific.

What is the most common DMARC quarantine mistake with SaaS senders?

Using your domain in the From address while the platform still authenticates with its own bounce or DKIM domain. The message looks branded, but alignment never happens.