auth.dmarc.quarantine

DMARC Policy Is 'quarantine'

What we check

We read the p= tag of the DMARC record. This finding reports p=quarantine. It is informational, but it is not free: the Authentication category starts at 89 points under quarantine and at 100 under reject, and this finding carries that difference so the score adds up.

What this finding means

Quarantine asks receivers to treat mail that fails DMARC as suspicious. In practice that means the spam or junk folder, sometimes a warning banner; the message is still delivered somewhere a person can open it. p=reject asks receivers to refuse the message outright.

Why it matters

• Spoofed mail still reaches a mailbox. A quarantined phishing message in a junk folder is one careless click away from being read.
• Quarantine is the rollout stage, not the destination. It exists so you can enforce while forwarded or misconfigured streams are found in the aggregate reports.
• pct= weakens it further. With pct below 100 only a sample of failing mail is quarantined; see auth.dmarc.pct_partial.

How to fix

1. Read the aggregate reports (rua=) until every legitimate stream aligns via SPF or DKIM.

2. Move to reject:

   copy

   _dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
   

3. Re-scan. Authentication starts at 100 once p=reject is in effect.