Email quarantined: your message was held at the recipient, with no bounce

You sent the message and no bounce came back, but a customer told you it went to their quarantine. A recipient who never saw your message has nothing to report, so the evidence has to come from their end.

Can you fix this from your side? Partly. You fix the cause, and only the recipient or their admin can release the held copy.

Quarantine versus a bounce

A receiver that refuses your mail answers with a 550, your server logs that line, and a bounce lands in your inbox. A receiver that quarantines answers 250, accepts the message, and then moves it out of the inbox.

RFC 5321 section 2.1 explains the silence. Once the server answers the end of the mail data with a success reply, "a formal handoff of responsibility for the message occurs". Your server did its job and has nothing left to report. The service on the far side applies its own rules after that, and it never writes back. To your server, a quarantine looks the same as a clean delivery.

RFC 7489 leaves the DMARC quarantine policy just as loose. The domain owner "wishes to have email that fails the DMARC mechanism check be treated by Mail Receivers as suspicious". The RFC leaves it to each receiver to define suspicious. Microsoft offers three choices: hold the message, drop it in the Junk Email folder, or deliver it with a marker added to the subject.

For the recipient

If you're the recipient, this section covers how to release the message. The rest of the page is for the sender.

Held mail sits in the Defender portal, on the quarantine list. Sign in with the work account the message was sent to, open the Email tab, and find the message by sender or subject. The Quarantine reason column shows the verdict: Spam, Bulk, Phishing, High confidence phishing, Malware, Transport rule or Password protected item.

A recipient runs into these limits:

• Release and Request release are different buttons. Microsoft blocks release for anything an anti-malware policy held, for anything Safe Attachments flagged as malware or phishing, and for high confidence phishing. At best the recipient asks, and an admin approves.
• Notification mail is optional. Microsoft turns it off in the quarantine policies named AdminOnlyAccessPolicy and DefaultFullAccessPolicy. It's on in DefaultFullAccessWithNotificationPolicy, which the preset policies use. Where it's on, the mail comes from quarantine@messaging.microsoft.com unless an admin picked another sender. The subject usually reads "Microsoft 365 security: You have messages in quarantine", and an admin can rewrite that too. It goes out every 4 hours, daily or weekly.
• Retention is 15 days by default. That is the default anti-spam policy. The Standard and Strict presets hold mail 30 days, and an admin can pick any value from 1 to 30. Mail held as malware or by a mail flow rule stays 30 days. Once a message expires, no one gets it back.

Microsoft's own quarantine guide covers the rest of the release process.

Your own DMARC policy

Check this cause first, because it's the one you can fix alone. Read the policy your domain publishes today:

If the answer contains p=quarantine, you asked every receiver to treat your failing mail as suspicious. A message that fails alignment then lands in quarantine at Microsoft, or in the Junk Email folder, depending on one setting in the recipient's tenant. No one made a mistake at their end. Our DMARC checker reads the same record back with the policy spelled out, and the SPF checker counts the lookups behind it.

Microsoft applies your policy through a setting called Honor DMARC record policy when the message is detected as spoof, which its settings reference lists as on by default. For p=quarantine, the choice is quarantine or the Junk Email folder, and the same reference gives Quarantine the message as the default. For p=reject, the two choices are quarantine and rejection, and Microsoft rejects by default.

Microsoft's DMARC article says the p=quarantine case goes to the Junk Email folder instead. The two pages disagree, so the tenant's setting is what counts. Either way, your own policy caused the hold.

Fix alignment, and leave the policy alone. One of SPF or DKIM has to pass for the domain in your visible From: address. In practice that means finishing the sending platform's domain setup and asking it for a custom return path. Reading dmarc=fail with p=REJECT explains the header field by field, and the alignment guide covers the platform settings that fix alignment.

Dropping to p=none stops the holds once resolvers pick up the change. RFC 7489 describes that policy as a request for no specific action, so you'd also lose the protection you published the record for. I would fix the sender and leave the policy where it is.

Aggregate reports

You can't see the recipient's quarantine. The closest you can get is a DMARC aggregate report, which you can ask for today. Microsoft sends aggregate reports for domains whose MX record points straight at Microsoft 365, to whatever address the rua= tag lists. It sends no forensic reports, whatever your ruf= tag says.

An aggregate report lists message counts per sending IP, whether each one aligned, and what the receiver did with them. When your own policy caused the hold, the host behind that message shows up in the next report as a failing source, with a count beside it. A spam or bulk hold doesn't show up that way, because that message passed DMARC on its way into quarantine. Publish a rua= tag if you have none:

Each receiver sends one report a day, as XML. Two outside services read them for you at no cost. Cloudflare's DMARC Management takes the reports on any Cloudflare plan, provided the domain's nameservers are at Cloudflare. Postmark's DMARC Digests work for a domain hosted anywhere and mail one summary a week. When I last checked, the free version listed 10 sources with 5 IP addresses each and 7 days of history, and $14 a month per domain lifted those limits.

Neither service can see inside the recipient's tenant, and neither can we. What you get from any of us is the list of your own sources that fail alignment, which is the part you can fix. Reading a report by hand covers the fields that matter if you would rather open the XML yourself.

DomainCanary reads those reports for you. The Starter plan costs $19 a month for 3 domains. On it, we mail you the day a source new to your domain first shows up failing, and the day a sender in your history stops passing. The weekly digest lists every host that sent as you and which of them aligned, and on the Business plan the domains arrive as a single email. If a week has nothing to act on, you can have us record it on the dashboard and keep it out of your inbox. We keep each source's daily totals for the life of the account, on the free plan as well as the paid ones. Your first domain is free, and the alert on the next failing source comes with the Starter plan.

Microsoft's verdicts

Your own policy can put a message in quarantine, and so can the recipient's filters. What each verdict does depends on which policy their tenant runs, and Microsoft's settings reference lists these defaults. In the tables below, Junk means their Junk Email folder, and the three columns are the default anti-spam policy, the Standard preset and the Strict preset. Bulk means mail at or above the tenant's own complaint level.

Microsoft rates spam, high confidence spam and bulk on one scale.

Verdict	Default	Standard	Strict
Spam	Junk	Junk	Quarantine
High confidence spam	Junk	Quarantine	Quarantine
Bulk	Junk	Junk	Quarantine

Microsoft rates phishing and spoofing on a second scale.

Verdict	Default	Standard	Strict
Phishing	Junk	Quarantine	Quarantine
High confidence phishing	Quarantine	Quarantine	Quarantine
Blocked spoofed sender	Junk	Junk	Quarantine

The phishing default depends on how the policy was made. Microsoft sets it to Junk in the default anti-spam policy and in new policies built in PowerShell, and to Quarantine message in a new anti-spam policy built in the Defender portal. Microsoft always quarantines high confidence phishing: "Malware and high-confidence phishing messages are always quarantined to protect the service."

The same message can get different treatment at two companies. At a tenant on default settings it reaches the Junk Email folder, where the recipient may still find it. At a tenant on the Strict preset it goes to quarantine, where they see it only if notifications are on.

The headers and the quarantine reason

The evidence you need is in their mailbox and their admin console. Ask for both, in one message, before you change any DNS.

1. The full message headers. A recipient can read these for most verdicts, under View message headers in the More menu on the Defender quarantine page. Malware and high confidence phishing are admin-only, so those come from their admin. The Authentication-Results: line says which check failed and what Microsoft did about it, in the form dmarc=fail action=quarantine header.from=example.com. Reading dmarc=fail with p=REJECT explains each field on that line.
2. The quarantine reason. The X-Forefront-Antispam-Report: header has a CAT: field, and its value shows the verdict more precisely than the word "quarantined". Their admin sees the same verdict in the Quarantine reason column.

Microsoft documents these CAT: values, among others.

Value	Verdict
SPM	Spam
HSPM	High confidence spam
BULK	Bulk
PHSH	Phishing
HPHSH or HPHISH	High confidence phishing
SPOOF	Spoofing
MALW	Malware
FTBP	Common attachments filter

Check the compauth reason code next to the DMARC line. compauth=fail reason=000 means the message failed DMARC and your published policy is p=quarantine or p=reject. Reason 001 means the message failed implicit authentication instead. That happens when your domain published no authentication records, or published a weaker failure policy: SPF ~all or ?all, or p=none.

Who fixes what

Sort out which side owns the cause before you spend a day on the wrong one.

What you own

• Alignment. Getting SPF or DKIM to pass for your From: domain fixes the DMARC cause, and the section above has the steps. It also drops the question mark Outlook puts on your sender photo. Outlook adds that mark when a message passes neither check and fails DMARC or composite authentication as well.
• Content and list hygiene. Microsoft bases a spam or bulk verdict on the message and the sending history behind it, so correct records don't change it.
• The attachment. A malware or common attachments filter verdict is about the file, and your DNS records don't affect it.

What their admin owns

• Releasing the held message. No one outside the tenant can do this.
• Allow entries. Their admin can add your domain or the spoofed pair to the Tenant Allow/Block List. Microsoft calls that temporary, and an allow entry expires in 30 days.
• Reporting a false positive to Microsoft. An admin submits that straight from the quarantine page.
• Policy strictness. Whether their tenant runs default settings, Standard or Strict is their call, and it explains why one customer sees your mail and another does not.

Ask by phone or from a different address. A follow-up from the same system reaches the same quarantine.

Gmail's Spam folder

Gmail has no quarantine for its own users. When a Gmail recipient says "quarantined", they nearly always mean the Spam folder. The message sits in their account and they can find it. Gmail sends you no notice about it.

Google Workspace does have an admin quarantine, and it works differently. An admin builds it from compliance rules, and Google states that recipients "are never notified when a message is quarantined". You hear about it only if the admin denies delivery and their setting sends the default reject message. Google holds that mail up to 30 days after sending and then deletes it.

When Gmail refuses a message outright you get a real bounce with a status code in it, and Message blocked covers reading that.

When to resend

Fix the cause the headers showed, then send one message to an address you can check. Send it to a mailbox at the company that told you, if they will take one. Keep the rest queued until that one arrives. If it reaches the inbox, the fix worked.

After that, the aggregate reports are how you find out whether the fix worked at companies that never wrote to you. They list every host sending as your domain and which ones align, and receivers send them whether or not anyone complains. Ask for them today, even if this message turned out to have a spam verdict you can't control.