p=quarantine or p=reject: which one to choose?

The real trade-off: false positives versus strength of protection

The whole decision sits in one tension: the harder the policy, the more it protects, but the higher the cost of an alignment error.

• Under quarantine, a forgotten source costs one email in spam — a visible, reversible incident a user can report.
• Under reject, that same forgotten source costs one vanished email — a potentially invisible incident until a customer complains they never received their confirmation.

So it isn't "which policy is best" in the abstract (reject always wins on protection), but which policy matches an organization's ability to guarantee its reports are clean. A domain with a simple, stable sending ecosystem can go straight to reject. A domain with twenty vendors, subsidiaries and a history of surprises is better off lingering in quarantine while it builds confidence.

When quarantine is a good destination — not just a step

The classic view treats quarantine as a mere landing before reject. That's true in most cases. But there are situations where stopping (temporarily) at quarantine is a legitimate choice, not timidity:

• Complex, shifting sending ecosystem. If new sources appear regularly (large decentralized organization, many subsidiaries), the spam-folder net has real operational value while the inventory stabilizes.
• Very low tolerance for silent loss. Some flows (customer support, critical notifications) are so sensitive that an email lost without trace costs more than an email in spam that gets reported.
• A confidence-building phase. Spending a few days — sometimes a few weeks — in quarantine before reject is healthy practice, not an admission of weakness.

The nuance matters: quarantine can be a deliberate transitional destination, but staying in quarantine indefinitely amounts to leaving a door ajar, since some receivers deliver spam to the user anyway.

When reject is warranted

Conversely, several contexts justify going all the way to reject without dragging:

• A brand with high impersonation value — banks, e-commerce, public sector, any domain whose name is currency for fraudsters. The detailed banking story is in DMARC for banks.
• Reports proven clean for several weeks, with no legitimate source failing. The false-positive risk is then near zero, and staying in quarantine only prolongs exposure.
• A compliance or partner requirement mandating strict enforcement.

In those cases, quarantine is just a verification airlock of a few days, not a destination.

What receivers actually do

A detail many miss: not all receivers handle quarantine the same way. Some respect it strictly (spam folder); others apply it more aggressively, close to a rejection; others still are more lax. The practical consequence: quarantine protects less uniformly than reject. With reject, the instruction is unambiguous and major providers behave consistently. That's one more argument against lingering in quarantine when nothing forces the wait. It also means a spoofed message's fate under quarantine can't be fully predicted: two recipients on two different providers may see the same forged email land in two different places. reject erases that variability — the message simply never arrives, everywhere, the same way.

Worth noting too: the policy actually applied depends on the observed alignment, verifiable coldly in the DMARC aggregate reports, which show, receiver by receiver, what disposition was really taken.

Indirect mail: forwarding and mailing lists

One flow reacts differently to the two policies: mail that reaches its recipient through an intermediary. A plain forward usually preserves the DKIM signature, so DMARC keeps passing. But a mailing list that rewrites the subject or appends a footer breaks DKIM, and forwarding breaks SPF alignment — the message then fails DMARC through no fault of the sender. Under quarantine, that message lands in the subscriber's spam folder, visible and recoverable. Under reject, it bounces — and some list software treats repeated bounces as a dead address and unsubscribes the reader. Many modern lists compensate by rewriting the From: when the author's domain enforces, which resolves the issue. The practical takeaway: scanning the reports for indirect flows before hardening. It's rarely a reason to avoid reject — but it's a reason to know beforehand.

An often-forgotten criterion: BIMI

Where displaying a logo in inboxes (BIMI) is one of the goals, the question is settled in advance: BIMI requires an enforcing policy (quarantine or reject, and many ecosystems ask for reject). Staying at none locks the domain out of BIMI; that's a concrete business argument for finishing the policy ramp, beyond security alone — the marketing team that wants the logo becomes an ally of the security team that wants enforcement.

A concrete example

Two domains with opposite profiles make the point.

The first belongs to a ten-person consultancy. It sends from a single platform (Google Workspace) plus a billing tool. Two sources, both DKIM-alignable in an afternoon. Its reports are clean within three weeks, with no legitimate IP failing. Here, lingering in quarantine gains nothing: false-positive risk is near zero, the ecosystem won't move, and every day short of reject is a day a phishing email can still land in a client's spam. Decision: quarantine over one weekend to verify, then reject.

The second is a local government with fifteen departments, each having historically wired up its own tools (newsletters, citizen alerts, HR platforms, event vendors). The inventory is never quite finished; a new source appears every quarter. Here the spam-folder net is worth gold: moving to reject too fast would make a forgotten department's email vanish without trace. Decision: quarantine as a deliberate destination for several months, while the inventory firms up, then reject once the flow stabilizes — never forgetting that quarantine remains a door ajar.

Same standard, same sequence, two different tempos — because the risk profile itself differs. The lesson isn't "consultancies go fast and governments go slow"; it's that the answer follows from how confidently the reports can be guaranteed clean, and how much a silent loss would hurt. Mapped honestly, those two axes tend to make the choice themselves.

Common mistakes

• Confusing quarantine with "haven't decided yet." Many domains sit in quarantine for years out of inertia, not choice. If nothing forces the wait, that's free exposure.
• Moving to reject on a snapshot. A single clean report isn't enough: catching monthly senders takes a trend over several weeks. The topic is covered in the readiness checklist.
• Forgetting subdomain policy. Hardening the root without setting sp and np leaves attackers a side door — see the subdomain policy (sp and np).
• Believing reject covers everything. It stops direct spoofing of the domain, not lookalike domains or display-name spoofing. It's a layer, not a total wall.

The decision framework, in one sentence

reject by default, with quarantine reserved for a transitional airlock — or for a conscious destination when a critical flow and a shifting ecosystem make silent loss costlier than reported spam. Either way, the decision must be made, not suffered: a policy chosen out of fear — "let's stay in quarantine, it's safer" — without having checked the reports is a default decision in disguise.

The full ramp (none → quarantine → reject) is walked step by step in getting to p=reject without breaking email; to master the pace of that hardening, see rolling out DMARC gradually.

Before the target policy goes live, the free DMARC analyzer shows the real alignment of every source and says, concretely, whether hardening is safe. It's the fastest way to replace the anxiety of the choice with a fact-based decision.