DMARC quarantine dispositions may signal overly aggressive filters

DMARC reports give domain owners a window into how receiving mail servers handle messages claiming to come from their domain. Three dispositions appear in those reports: none, quarantine, and reject. A healthy mix leans on "none" while legitimate mail flows freely, with a small percentage of "reject" outcomes catching spoofers. When administrators open their reports and see the "quarantine" column dominating the data, the message is rarely comforting.

A wave of quarantined messages often signals that filters sitting between the public internet and the recipient's inbox have become stricter than the publishing domain intended. The policy written into DNS is only half the story. The other half lives inside the proprietary reputation engines run by major mailbox providers, which can quietly escalate their treatment of suspicious traffic well beyond what the domain owner asked for.

Reading the language of DMARC reports

Aggregate reports, sent as XML files usually once a day, break down every authentication attempt by source IP, count, and SPF/DKIM result. Each message is tagged with the disposition the receiver ultimately applied. A "none" tag means the message was delivered as usual, "quarantine" means it landed in spam or junk, and "reject" means it never arrived at all.

The proportions matter far more than the raw counts. A handful of rejects among thousands of none tags is what a well-tuned policy looks like. But when quarantine outcomes climb into double-digit percentages of total volume, something inside the receiving infrastructure is making judgement calls that may not match the published policy. For Australian businesses sending from a .com.au domain, that mismatch can quietly throttle customer communications without anyone noticing for weeks.

When quarantine becomes the default

Mailbox providers tend to quarantine messages when authentication passes but reputation signals are weak. A new sending IP, a low-volume sender that suddenly scales, or a campaign that trips spam heuristics can all push a legitimate message into the junk folder rather than the inbox. When most traffic for a domain lands there, the provider is effectively treating the sender as borderline hostile.

This behaviour reflects a defensive default in large cloud providers. If a security team cannot be sure a stream of mail is wanted, the safer action is to hide it from the user. The Australian Cyber Security Centre has long encouraged this cautious posture, and major global providers apply similar logic, sometimes more aggressively than local regulations would require.

Why filters drift toward aggression

Reputation engines are trained on huge volumes of data and updated frequently. A pattern that looked benign six months ago can become a trigger today. Bulk sending from shared infrastructure or a sudden spike in volume after a quiet period can push a domain's score downward.

Forwarding chains also confuse the picture. When an Aussie tradie in Perth forwards a confirmation email through a personal Gmail account, the original DKIM signature often breaks. The receiving server sees an unsigned message claiming to be from a legitimate sender and quarantines the result. Multiply that by thousands of forwarded messages and the quarantine column fills up quickly.

Real consequences for Australian senders

For organisations operating under APRA's CPS 234 information security obligations, or any business that takes its customer communications seriously, a flood of quarantined messages means customers stop seeing receipts, appointment reminders, and shipping updates. A Sydney-based e-commerce shop might see order confirmations vanish while the customer service team keeps telling people to check spam folders.

The reputational damage compounds quietly. A customer who misses a delivery notification blames the retailer, not the underlying mail infrastructure. Over time, the brand becomes associated with unreliable communication. Verifying authenticity from financial institutions becomes harder when customers have learned to expect important messages in junk folders rather than inboxes.

Diagnosing the imbalance

The first step is separating aggregate disposition data from forensic reports. Forensic reports, when enabled, show the actual message headers and content, making it easier to see whether quarantined messages look like legitimate transactional mail or obvious phishing attempts. A useful place to begin is the domain administration panel where authentication settings, report delivery, and policy state are managed in one place.

Admins should also map quarantine percentages against known campaigns. If a particular newsletter blast correlates with a spike in junk folder placement, the sending infrastructure or list hygiene is likely the culprit. Tools that break down dispositions by source IP help separate genuine spoofing from accidental over-filtering.

Rebalancing policy without losing protection

A p=none policy is fine for monitoring but offers no protection. Moving to p=quarantine with a low percentage value tells receivers to act cautiously on a fraction of failures, easing the impact of over-zealous filtering while still gathering data. Once the report shows a stable authentication picture, gradually tightening to p=reject becomes safer.

Throughout the process, keeping tabs on legitimate mail streams is critical. Warming up new IPs, signing every message with DKIM, and aligning the From domain with the envelope sender all reduce the signal noise that triggers aggressive filtering. A domain that consistently authenticates clean mail will see its quarantine numbers fall naturally, leaving only genuine phishing attempts in that column where they belong.