What does quarantine mean in email?

Definition

In DMARC, quarantine is the middle enforcement level: p=quarantine asks receivers to accept a failing message but treat it as suspicious instead of delivering it normally. The standard deliberately does not say where suspicious mail goes; each receiver decides.

Where quarantined mail actually lands

• Consumer mailbox providers (Gmail, Yahoo, and most others) put it in the recipient's spam folder. The message is technically delivered; in practice, almost nobody sees it.
• Business suites can hold it in an administrative quarantine instead: Microsoft 365, for example, can route DMARC failures to a quarantine console where admins review and release messages.
• Some gateways deliver it flagged, relying on a banner or a raised spam score rather than a separate folder.

Quarantine vs reject

The practical difference is recoverability. Quarantined mail exists: a user can fish it out of spam, an admin can release it, and a false positive costs attention rather than the message. Rejected mail never arrives, and the sender gets the bounce. That makes quarantine the natural rehearsal step on the way to p=reject: your aggregate reports show what enforcement would hit, while real mistakes remain fixable. The trade-off is that quarantine is weaker against phishing, since a determined victim can still open the spam folder.

One more meaning

You will also meet “quarantine” as a general mail-security term: gateways and antivirus layers quarantine messages for malware or content reasons that have nothing to do with DMARC. If a message is “in quarantine,” check whose: the receiver's DMARC handling, or a security product applying its own rules.