A quarantined email is a message that a recipient’s email security system holds for review rather than delivering to the inbox, spam folder, or another normal mailbox location. It is usually flagged as suspicious or unwanted—not necessarily malicious—and may be released, deleted, or reported by the recipient or their administrator.

What does quarantined email mean?

A quarantined email is mail that reached the receiving organization’s filtering infrastructure but was intercepted before ordinary delivery. The receiving system decided the message carried enough risk, or enough signs of unwanted mail, to place it in a controlled review area called quarantine.

That distinction matters. A message that is quarantined is not the same as a message that hard bounced, was rejected at the SMTP level, or simply landed in the junk folder. The recipient’s environment may have technically accepted the message, but its security controls prevented the message from being exposed in the usual mailbox view.

Quarantine is most common in business environments that use a secure email gateway (SEG), a cloud email-security product, or a mailbox provider with advanced phishing, malware, and spam defenses. A company may give employees the ability to review certain quarantined messages, while reserving more dangerous categories—such as malware or high-confidence phishing—for security administrators.

For a sender, the practical outcome is uncomfortable: a campaign or transactional message can look delivered in sending logs while the intended person never sees it in their inbox. The email may be waiting in a recipient’s quarantine portal, may be bundled into a periodic notification, or may be deleted after a retention period.

Quarantine is a recipient-side decision

A sending platform can authenticate, submit, and successfully hand off a message to a receiving mail system. After that handoff, the recipient’s security stack can still classify the message as suspicious and quarantine it.

This means an email API’s accepted or delivered event should not be interpreted as proof of inbox visibility. Delivery confirms a receiving server accepted the message. Deliverability asks the broader question: did the message reach a place where the recipient is likely to notice, trust, and act on it?

A recipient organization can also use its own local policies. One company may quarantine a particular message because it has strict attachment rules, aggressive impersonation protection, or a policy that holds mail from newly seen external senders. Another company may accept the same message into the inbox. That variation is why quarantine problems often appear concentrated among certain corporate domains rather than across an entire sending list.

Quarantined email versus other email outcomes

These terms are related, but they describe different stages and outcomes:

Accepted: The sending service accepted a message for processing. It has not necessarily reached the recipient domain yet.
Delivered: The recipient mail server accepted the message. It may still be in the inbox, junk folder, quarantine, or another filtered location.
Deferred or queued: Delivery is temporarily delayed, often because the recipient server is busy, rate-limiting mail, or temporarily unavailable.
Bounced: The receiving server did not accept delivery. A hard bounce generally indicates a permanent issue; a soft bounce may be temporary.
Spam or junk placement: The message appears in a recipient-visible spam folder rather than the inbox.
Quarantined: A security system holds the message outside the normal mailbox flow for review, policy handling, or eventual deletion.
Rejected: The recipient system refuses the message during delivery, often returning an SMTP response explaining the reason.

The important operational point is that quarantine often sits in the gap between “the receiver accepted it” and “the recipient could use it.” For a password reset, invoice, login alert, or time-sensitive product notification, that gap can have the same business impact as a failed delivery.

Why quarantined email matters for deliverability

A quarantined email reduces the real-world value of every message held. The recipient cannot easily read it, click a confirmation link, complete a purchase, approve an invoice, or follow an account-security instruction. Even if an employee eventually releases the message, the delay may make the email irrelevant.

For marketing campaigns, quarantine can lower apparent engagement. Opens and clicks decline because many recipients never encounter the email. Conversion rates fall for reasons that may be incorrectly attributed to offer quality, subject lines, timing, or landing pages. A sender can waste time optimizing creative when the more immediate problem is that a security control has withheld the campaign.

For transactional email, the consequences are often more direct. Consider these examples:

A new customer cannot verify an email address because the confirmation message is quarantined.
A user is locked out because a one-time passcode or password reset email is delayed.
A procurement team misses an invoice or contract notification.
A customer does not receive an order confirmation and contacts support.
An internal workflow fails because a system alert never reaches the on-call team.

Quarantine can also create an uneven customer experience. Consumer mailbox providers may deliver a message normally, while recipients at a bank, university, healthcare organization, government agency, or large enterprise see it held in quarantine. If those organizations make up a meaningful share of your audience, overall delivery metrics can look healthy while important accounts experience a much worse result.

The second-order effects of quarantine

The first-order effect is that a person does not see an email promptly. The second-order effects are broader:

Support volume rises. Users contact support for missing receipts, invites, reset links, alerts, and verification messages.
Security trust erodes. Recipients who find legitimate security emails in quarantine may become less confident in future messages.
Engagement signals weaken. Low engagement can reinforce a weak sender reputation over time, especially for recurring promotional traffic.
Sales cycles lengthen. Account teams may need to resend messages manually, switch channels, or ask a recipient’s IT team to investigate.
Operational automation becomes less reliable. Systems built around email-based approvals, notifications, and handoffs can stall.

For this reason, quarantine should be treated as a deliverability and product-reliability issue—not merely as an IT inconvenience at the recipient’s company.

Is quarantined email a metric?

“Quarantined email” describes a message status or recipient-side outcome, not a universal email metric with one standard definition. There is no single quarantine rate that every mailbox provider, security gateway, or email-sending platform reports consistently.

Many senders cannot directly measure all quarantined messages. A receiving system may accept the email and then make its filtering decision internally, without sending a standardized event back to the sender. The sending platform may record the message as delivered because the remote server accepted responsibility for it.

That does not make quarantine unmeasurable. It means teams need to combine several signals rather than expecting a single definitive dashboard number.

A useful quarantine-rate formula

When you have reliable data from seed tests, recipient reports, security gateway feedback, or an enterprise customer’s mail administrators, calculate a quarantine rate as:

Quarantine rate = (confirmed quarantined messages ÷ messages delivered to the measured audience) × 100

Use a clearly defined denominator. For example, if you are investigating delivery to one customer’s Microsoft 365 tenant, calculate the rate only for messages sent to that organization during the test period. Do not divide by every email sent to all domains, because that can hide a serious domain-specific problem.

Worked numeric example

Suppose a SaaS company sends 2,000 account-invitation emails to employees at a large enterprise customer over one month. Sending logs show that 1,960 messages were delivered; 40 bounced or were rejected before delivery. The customer’s mail administrator reviews the quarantine portal and confirms that 147 of the 1,960 delivered messages were held there.

Quarantine rate = (147 ÷ 1,960) × 100
Quarantine rate = 7.5%

The measured quarantine rate is 7.5%.

That is a meaningful finding even though the sender’s conventional delivery rate appears strong:

Delivery rate = (1,960 ÷ 2,000) × 100 = 98%

A 98% delivery rate may sound excellent. But if 7.5% of those delivered messages are quarantined, then a significant subset of intended recipients cannot readily access them. The team should investigate why the enterprise’s security controls distrust the traffic before treating the campaign as successful.

What to measure alongside quarantine

Because confirmed quarantine data is incomplete in many environments, monitor leading and supporting indicators:

Delivery, bounce, and deferral rates by recipient domain.
Spam-complaint and unsubscribe rates for marketing mail.
Open, click, and conversion rates segmented by domain type, especially business domains.
Support tickets mentioning missing emails, held mail, or “check your quarantine.”
Authentication pass results from test messages and message headers.
DMARC aggregate reports, which can reveal unauthorized sources and alignment failures.
Seed-test placement results across major mailbox providers and business-security environments.
Recipient-domain-specific error patterns, including reputation or policy-related SMTP responses.

Track transactional and promotional mail separately. A marketing campaign can create reputation pressure that affects password resets and receipts if both streams use the same visible sending identity, domain reputation, or IP reputation.

Common causes of quarantined email

A message can be quarantined for one strong signal or for a combination of weaker signals. Security systems do not disclose every rule, score, model, or threshold they use. Still, the most common categories are understandable and actionable.

Authentication failures and domain misalignment

Authentication is a foundational cause. Receiving systems evaluate signals such as SPF, DKIM, and DMARC to determine whether a message is legitimately associated with the domain displayed in the From header.

A message may be quarantined when it fails SPF, DKIM, or DMARC; when authentication passes but the authenticated domain does not align with the visible From domain; or when a third-party system sends on behalf of a domain without being properly configured. DMARC is especially relevant because it lets a domain owner publish a policy for handling messages that fail alignment checks.

A common setup error occurs when a company sends mail from news.example.com, notify.example.com, and example.com through different services but configures authentication for only one sending path. Another occurs when an application uses a From address at the company’s main domain while the actual sending provider signs with an unrelated or misaligned domain.

Authentication is not a guarantee of inbox placement, but missing or broken authentication makes quarantine much more likely. Google’s sender guidelines require authentication for all senders and impose additional SPF, DKIM, and DMARC expectations on high-volume senders to personal Gmail accounts.

New, inconsistent, or damaged sender reputation

Mailbox providers and security gateways assess the trustworthiness of the infrastructure and identity behind a message. Relevant reputation signals can include the sending IP, sending domain, DKIM signing domain, From domain, historical complaint patterns, sending consistency, recipient engagement, and whether the sender is known to the receiving environment.

A sudden spike in email volume is a common risk. A domain that normally sends a few hundred emails per day and abruptly sends tens of thousands may resemble a compromised account, a purchased-list campaign, or a poorly controlled marketing blast. The problem becomes worse when the new volume targets unengaged or outdated addresses.

Reputation can also be harmed by mixing fundamentally different mail streams. High-value receipts and password resets typically have strong engagement and low complaint rates. Bulk promotions can attract complaints and low engagement. If both share the same identity and infrastructure without thoughtful separation, promotional performance can affect business-critical mail.

Phishing, impersonation, and lookalike signals

Security products are designed to detect attempts to impersonate executives, vendors, brands, banks, and internal departments. Legitimate senders can accidentally resemble those attacks.

Examples include a From name that changes often, messages requesting payment or credentials, a reply-to address different from the visible sender, unexpected account-security language, or a display name that resembles an employee or corporate department. A vendor notification that says “Urgent: update payment details” can look risky even if it is legitimate.

The risk is higher when content, identity, and destination do not match recipient expectations. For instance, a developer tool sending a surprise invoice request from a recently created subdomain to an employee who has never interacted with the product may trigger multiple suspicion signals.

Content and formatting problems

Content alone rarely explains every quarantine decision, but it can contribute significantly. Filters may react to deceptive wording, aggressive calls to action, misleading display text, unusual HTML, hidden content, URL mismatches, malformed MIME structure, or an email that looks materially different from a sender’s normal templates.

Potential triggers include:

Excessive urgency, threats, or financial-pressure language.
Links whose displayed text does not match their destination domain.
Multiple redirects or unfamiliar tracking domains.
Image-only emails with little meaningful text.
Broken HTML, invalid characters, or suspiciously obfuscated markup.
Attachments that are unnecessary, password-protected, executable, or commonly abused.
A sudden template redesign that materially changes a familiar sender’s appearance.

Good email design is not just visual. It includes readable text, a clear sender identity, predictable branding, usable plain-text content, working links, and a message structure that can be safely inspected by security tools.

Links, attachments, and destination reputation

A message can be quarantined because of what it points to, not only because of who sent it. Secure email gateways often inspect URLs, attachment types, attachment content, and the reputation of linked domains.

A legitimate campaign may become risky when it uses a newly registered tracking domain, a shortened URL, a compromised landing page, or a third-party redirect chain the recipient organization does not trust. Similarly, an otherwise normal email with an unfamiliar attachment can be held until it is scanned or reviewed.

Avoid attaching files when a secure authenticated portal, known document-hosting location, or clearly branded download experience is more appropriate. If an attachment is necessary, use a conventional format, explain why it is attached, and ensure recipients are expecting it.

Poor list quality and weak recipient consent

List quality affects reputation, which affects filtering. Sending to stale, purchased, scraped, guessed, or poorly consented addresses can generate bounces, complaints, low engagement, and spam-trap exposure. Those outcomes increase the chance that later mail receives stricter treatment.

A quarantine problem at one recipient organization may begin with a single campaign sent to a bad list. Once the organization’s security controls or users classify the sender as unwanted, even legitimate future messages can face tougher filtering.

Use explicit permission, disclose the type and frequency of mail people will receive, and make unsubscribing straightforward. Before high-volume campaigns, remove known invalid addresses and consider validating newly collected addresses with an email address verification tool.

Recipient-specific security policies

Not every quarantine event indicates a sender mistake. The receiving organization may have an intentionally strict policy that quarantines categories of mail such as bulk messages, external invoices, password-protected archives, newly observed senders, spoof-like messages, or emails with certain attachment types.

Microsoft 365, for example, supports quarantine policies that can differ by detection category and can define what users are allowed to do with quarantined messages. A recipient organization may permit users to release low-confidence spam but require administrators to handle high-confidence phishing or malware detections.

When a problem appears only at one company, work with that company’s IT or security team. Ask for the specific detection category, the relevant message headers, timestamps, and the reason shown in their security console. Do not immediately ask them to broadly allowlist an entire domain or IP range; that can weaken their security posture and may mask an underlying configuration problem.

How to diagnose quarantined email

Diagnosing quarantine requires separating sender-side facts from recipient-side facts. Start with the message and work outward: submission, delivery attempt, recipient response, authentication, content, links, and recipient security policy.

Step 1: Confirm the exact message and audience

Collect the message ID, sending timestamp in UTC, recipient address or domain, envelope sender, From address, subject line, tags or campaign identifier, and delivery event. These details let a sending team locate the outbound message and let the recipient’s administrator search their own logs.

Do not diagnose from a screenshot alone. A screenshot can prove that a user saw a quarantine notice, but headers and event data are needed to determine how the message was authenticated and what infrastructure sent it.

Step 2: Determine whether it was actually quarantined

Ask the recipient to check whether the message is in a quarantine portal, a daily digest, a spam folder, or a mail rule folder. These outcomes can look similar to an end user, but the remedies differ.

If possible, involve the recipient organization’s mail administrator. They can determine the security verdict, whether a URL or attachment triggered the hold, whether the message was released, and whether other messages from the sender were treated the same way.

Step 3: Inspect authentication headers

Obtain the full headers from a delivered test message or from the recipient’s security team. Look for results such as SPF pass or fail, DKIM pass or fail, DMARC pass or fail, alignment information, and any annotations added by the receiving gateway.

Authentication failures should be fixed before creative experimentation. Verify that every service authorized to send mail for a domain is represented in SPF where appropriate, that DKIM signing is enabled and valid, and that the visible From domain has a DMARC policy that matches the organization’s sending architecture.

Avoid making DNS changes blindly. SPF has lookup and record-construction constraints, and adding every vendor indiscriminately can create a fragile record. Maintain an inventory of all legitimate senders, remove unused providers, and test changes carefully.

Step 4: Compare successful and quarantined messages

Compare a message that reached the inbox with one that was quarantined. Check the sending domain, DKIM domain, envelope sender, IP or infrastructure path, reply-to address, subject line, HTML, links, attachments, and recipient organization.

This comparison is especially valuable when transactional and marketing systems are separate. You may discover that receipts sent through one authenticated domain are fine, while product announcements sent through another system have broken alignment or use an untrusted tracking link.

Step 5: Test safely and narrowly

Send controlled test messages to authorized test accounts rather than repeatedly resending to production recipients. Change one meaningful variable at a time: authentication configuration, From domain, reply-to address, link domain, attachment, template, or sending cadence.

A test can demonstrate that a particular configuration improves treatment at a specific recipient environment. It cannot prove that every mailbox provider will make the same decision. Treat results as evidence, not as a universal guarantee.

How to prevent quarantined email

The most reliable prevention strategy combines technical authentication, stable sending practices, clean recipient acquisition, safe content, and ongoing monitoring. There is no single setting that guarantees a message will never be quarantined.

1. Authenticate every legitimate sending source

Set up and maintain SPF, DKIM, and DMARC for every domain and subdomain used in visible sender identities. Ensure the systems that send transactional mail, marketing mail, support mail, and automated application alerts are included in your authentication plan.

Alignment matters, not just pass results. A message that passes an unrelated SPF check or is signed by a domain unrelated to the visible From address may not provide the trust signal receivers expect. Use domains intentionally and keep the relationship between the From address, DKIM signature, and envelope sender understandable.

Publish DMARC gradually when needed: first observe legitimate and unauthorized traffic, then correct alignment and unknown sources, and only then increase enforcement as appropriate. The goal is to protect the domain without disrupting legitimate mail.

2. Use predictable sender identities

Keep the From name and From address stable enough that recipients recognize them. A product’s login alerts should not come from a different brand-like name every week, and an invoice workflow should not suddenly switch to a new domain without explanation.

Use separate, purpose-specific subdomains where that makes operational sense—for example, one identity for product notifications and another for marketing mail. Separation can make reputation analysis cleaner and reduce the chance that high-complaint promotional traffic affects critical messages. It is not a substitute for good sending behavior.

3. Build reputation at a controlled pace

New domains, new IPs, and new sending paths need a measured ramp-up. Begin with recipients most likely to recognize and engage with your mail, maintain a consistent schedule, and increase volume as positive history develops.

Avoid importing a large old list and sending to everyone at once. Segment by recent activity, confirmed consent, customer status, or previous engagement. Suppress invalid addresses, prior complaints, and long-inactive recipients according to your organization’s policies.

If your infrastructure changes, monitor results more closely than usual. A domain migration, new sending provider, altered tracking domain, or redesigned template can change the signals receiving systems see.

4. Make marketing mail easy to recognize and leave

Marketing messages should clearly identify the sender, honor expectations set at sign-up, and contain a visible unsubscribe mechanism. For high-volume mail, one-click unsubscribe support and list-unsubscribe headers are important ecosystem expectations as well as practical ways to reduce spam complaints.

Do not hide the unsubscribe option behind login walls, vague preference centers, or confusing wording. A recipient who cannot easily opt out may report the message as spam, creating a much worse reputation signal than an unsubscribe.

5. Reduce content and link risk

Use familiar branded domains for links where feasible. Avoid unnecessary URL shorteners, excessive redirect chains, mismatched display URLs, and obscure third-party destinations. Review links after every template or campaign change; a tracking configuration error can make a legitimate CTA look suspicious.

Keep HTML clean, include a useful plain-text version, and do not rely on images to communicate the entire message. Avoid manipulative urgency or language that resembles credential theft, payment fraud, or executive impersonation—particularly when recipients have not initiated the conversation.

Test attachments carefully. If a file is essential, explain it in the email, use a conventional type, and ensure the surrounding context tells recipients why they should expect it.

6. Keep transactional mail separate from bulk campaigns

Password resets, receipts, verification emails, alerts, and billing notices are operationally different from newsletters and promotions. Separate them by stream, message type, tags, and preferably by clearly planned sending identities.

This lets teams monitor performance independently and identify whether a reputation or content issue is limited to one category. It also ensures that a large marketing send does not obscure time-sensitive transactional delivery problems in reporting.

Your email infrastructure should give developers and deliverability teams access to the relevant delivery events, message metadata, and setup guidance. Review the available email API reference and setup guides before implementing sending logic, authentication, retries, or event handling.

7. Create a recipient-side escalation process

For important B2B recipients, establish a repeatable path for reports of missing email. Support, customer success, engineering, and deliverability teams should know what data to collect and who can communicate with the recipient’s mail administrator.

A good escalation request includes the sender domain, recipient domain, exact timestamp, subject line, message ID, authentication results, sending IP or provider details when relevant, and a request for the detection category or policy explanation. This is more useful than asking a customer to “allowlist us” without evidence.

What recipients and administrators can do

A quarantined message is not always a sender-side configuration problem. Recipients and email administrators also have a role in resolving false positives safely.

A recipient can review quarantine notifications if their organization permits it, inspect the sender and message context, and request release when the mail is expected and legitimate. A user should not release messages merely because they recognize a display name; attackers can spoof names and imitate trusted brands.

Administrators can review the security verdict, message headers, URLs, attachments, impersonation signals, and prior history for the sender. If the message is a false positive, they can release it and, where appropriate, tune a narrowly scoped policy. Narrow controls are generally safer than broad exceptions that bypass multiple security layers for an entire external domain.

The best remediation is usually mutual: the sender repairs authentication, identity, or content issues, while the recipient organization adjusts an overly broad rule only when it understands the sender and business need. This preserves security while improving legitimate mail flow.

Quarantined email and DMARC quarantine are not identical

The phrase “quarantined email” can refer to a message held by a recipient’s security system. “DMARC quarantine” is more specific: it refers to a DMARC policy instruction, commonly expressed as p=quarantine, that tells receivers how to handle mail that claims to be from a domain but fails DMARC evaluation.

These concepts overlap, but they are not interchangeable.

A message can be quarantined even when DMARC passes. For example, a gateway may hold it because of attachment malware, a suspicious URL, phishing-like content, or a local security policy. Conversely, a domain may publish a DMARC quarantine policy, but a receiving system can choose its own practical handling based on its evaluation and policies.

For senders, the takeaway is simple: do not assume that passing DMARC resolves every quarantine issue, and do not assume that every quarantine event means your DMARC policy caused it. Review the actual security verdict and message evidence.

A practical quarantine-response checklist

When customers report that legitimate messages are being held, use this sequence:

Confirm the exact recipient, timestamp, subject, and message ID.
Verify whether the message was delivered, bounced, deferred, sent to junk, or placed in quarantine.
Ask the recipient’s email administrator for the security verdict and hold reason.
Inspect SPF, DKIM, and DMARC results and alignment in the message headers.
Compare a quarantined message with a similar successful message.
Review From, reply-to, envelope sender, link domains, attachments, and template changes.
Check sending-volume changes, audience quality, complaints, and recent reputation signals.
Test a corrected message with authorized test recipients.
Document the fix and monitor the affected recipient domain after the next production send.
Avoid broad allowlisting until you understand the root cause and have considered safer, narrower alternatives.

This process prevents teams from treating quarantine as an unexplained black box. Most cases yield useful evidence once the sender and recipient-side administrator compare the same message.

Conclusion

A quarantined email is a message held by a recipient’s security controls instead of being delivered through the normal mailbox experience. It is not automatically malicious, and it is not always the sender’s fault—but it is always a sign that the message failed to earn enough trust for ordinary delivery.

The strongest defense is disciplined email operations: authenticate every legitimate source, align visible identities with sending domains, protect list quality, send at a consistent pace, use trustworthy content and links, separate critical transactional mail from bulk promotions, and investigate recipient-specific reports with real message evidence.

Traditional delivery rates remain useful, but they are not the whole story. If important recipients cannot find a message because it is in quarantine, the message has not achieved its business purpose. Monitor for that gap and treat quarantine findings as actionable deliverability intelligence.

FAQ

Is a quarantined email the same as a bounced email?

No. A bounced email was not accepted for delivery by the receiving system. A quarantined email was generally accepted into the recipient environment but held by a security control before normal mailbox delivery.

Can an email be delivered and quarantined at the same time?

Yes. A sending platform may record the message as delivered when the recipient server accepts it. The recipient’s security system can then place it in quarantine, so technical delivery does not necessarily mean inbox visibility.

Does DMARC `p=quarantine` mean all of my emails are quarantined?

No. A DMARC quarantine policy applies to messages that claim to be from your domain and fail DMARC evaluation. Legitimate, correctly authenticated, aligned messages should pass DMARC; receiving systems also apply their own filtering decisions.

Can a sender see every quarantined email?

Usually not. Quarantine is often a recipient-side action, and many receiving systems do not send a standardized quarantine event back to the sender. Sender logs, seed testing, recipient reports, headers, and administrator feedback must be combined.

Should a recipient allowlist a sender whose emails are quarantined?

Only after reviewing why the message was held. A narrow, carefully scoped exception may be appropriate for a verified legitimate sender, but broad allowlisting can bypass valuable protections and hide problems the sender should fix.

Quarantined Email: Meaning, Causes, and How to Prevent It