Why p=quarantine without DKIM still lets forgeries reach the inbox

A domain can publish an apparently strict DMARC policy and still be linked to forged mail that reaches a user. The key issue is why a domain with a p=quarantine policy but no DKIM permits that outcome. Authentication results, DMARC alignment and the receiving gateway’s response must all be considered.

DMARC does not require both SPF and DKIM. It passes when either SPF or DKIM passes and aligns with the visible From domain. Without DKIM, SPF becomes the only route to a pass, making the strength of that single mechanism decisive.

This matters in Australia, where small and midsized businesses often use .com.au or .au domains. Sydney, Melbourne and Brisbane offices may rely on different mail gateways, while invoices and supplier documents move through Microsoft 365, Google Workspace and managed service providers.

Quarantine is a requested outcome, not a universal delivery ban. A platform might isolate a failure, label it suspicious or let an administrator release it. This variation allows mail tied to a legitimate-looking domain to appear in an inbox despite an incomplete sender configuration.

SPF can satisfy DMARC on its own

SPF checks the envelope sender, often shown in Return-Path, rather than the visible From address. If the sending host is authorised for the domain, SPF can pass while an attacker controls the displayed mailbox name. DMARC compares the authenticated envelope domain with the visible domain; deceptive local-part text does not break alignment.

A broad SPF policy, a shared-platform include or a compromised sending account can give hostile mail an authorised route. With no DKIM signature to provide another identity check, an aligned SPF pass may satisfy DMARC by itself. The missing DKIM record removes a second line of defence rather than automatically causing a DMARC failure.

Trusted Sender Score’s email sender FAQ explains how to read SPF, DKIM and DMARC together instead of treating a published policy as proof that every message was blocked.

Quarantine is not the same as rejection

A p=quarantine policy asks receiving software to isolate mail that fails DMARC, but it does not define an identical experience across providers. Some services use a dedicated administrator quarantine, others route the message to junk, and some preserve exceptions for selected senders or business workflows.

An administrator may release a quarantined invoice so a customer is not inconvenienced, while another gateway may deliver a failed message with a warning and log it for review. A business with a Sydney headquarters and a Queensland branch can therefore see different outcomes. The DNS policy sets the standard; each receiving organisation applies it.

Missing DKIM increases exposure

DKIM adds a cryptographic signature to selected headers and ties that signature to the sender’s domain. It supplies a second identity check, especially useful when forwarding, mailing lists or shared cloud infrastructure weaken SPF. Without DKIM, receivers depend entirely on SPF and correct handling of DMARC failures.

Missing DKIM alone does not prove phishing, and an SPF error may reflect a transport problem rather than an attack. The platform’s SPF record review guide explains how to inspect the relevant DNS before a finance team follows an altered bank instruction. Attackers often imitate Australian invoice customs, using a plausible Xero or MYOB bill or a request for an urgent supplier payment.

Verify more than the visible sender

Authentication indicates that configured infrastructure or a domain was involved; it does not prove that the request is safe. A compromised mailbox can send fully authenticated phishing, and a valid signature cannot make a fraudulent invoice legitimate. Recipient-side verification remains necessary.

Government communication makes that distinction important. Australian agencies use domains under ato.gov.au, my.gov.au and services.gov.au, and forged notices can closely imitate their branding. Trusted Sender Score’s government email verification notes show how to compare the exact sending domain and authentication results with the agency named in the message.

Across the Australian market, IT teams and managed service providers can use bulk checks to find inconsistent DKIM, SPF and DMARC settings across a .com.au portfolio, while an API can support procurement or help-desk workflows. For individuals, the practical response to an unusual request is to confirm it through a known channel rather than relying on the display name or a polished PDF.

Build a layered authentication policy

Each layer should carry a defined job: SPF authorises specific sending hosts, DKIM signs the visible domain, and DMARC aligns at least one identifier with the chosen policy. A p=quarantine policy without DKIM should be viewed as incomplete assurance, particularly where SPF is broad, delegated or difficult to monitor.

Organisations can pair tighter authentication with explicit quarantine handling, DMARC report monitoring and tests of real messages from mobile apps and forwarding services. Australia’s Privacy Act also matters: shared review folders and authentication logs should contain only necessary information and remain properly protected. Together, these controls create a sequence from sender authorisation to domain signing, alignment and a predictable recipient outcome, reducing the gap that makes partial configurations appear trustworthy.