Bounce and error codes

Email quarantined: your message was held at the recipient, with no bounce

Last updated 2026-08-24

You sent the message and no bounce came back. Your logs recorded a delivery, and days later a customer told you it went to their quarantine. You know about that one because they mentioned it, and a recipient who never saw your message has nothing to report. Every other error page here starts from a rejection string you can paste. This one starts from silence and a secondhand account, so your proof has to come from the other end.

Quarantine takes the message, then holds it

A receiver that refuses your mail answers with a 550, your server logs that line, and a bounce lands in your inbox. A receiver that quarantines answers 250, takes the message, and files it out of sight afterwards.

RFC 5321 section 2.1 explains the silence. Once the server answers the end of the mail data with a success reply, "a formal handoff of responsibility for the message occurs". Your server did its job and has nothing left to report. The service on the far side applies its own rules after that, and it never writes back. So a quarantine looks like a clean delivery from where you sit.

RFC 7489 leaves the DMARC quarantine policy just as loose. The domain owner "wishes to have email that fails the DMARC mechanism check be treated by Mail Receivers as suspicious". Each receiver decides what suspicious means, and Microsoft names three of them: hold the message, drop it in the Junk Email folder, or deliver it with a marker added to the subject.

Recipients release it in the Defender portal

Some readers land here holding the other end of this problem. If you are the recipient, this section is yours and the rest of the page is for the sender.

Held mail sits in the Defender portal, on the quarantine list. Sign in with the work account the message was sent to, open the Email tab, and find the message by sender or subject. The Quarantine reason column names the verdict: Spam, Bulk, Phishing, High confidence phishing, Malware, Transport rule or Password protected item.

Three limits shape what a recipient can do:

• Release and Request release are different buttons. Microsoft blocks release for anything an anti-malware policy held, for anything Safe Attachments flagged as malware or phishing, and for high confidence phishing. At best the recipient asks, and an admin approves.
• Notification mail is optional. Microsoft turns it off in the quarantine policies named AdminOnlyAccessPolicy and DefaultFullAccessPolicy. It runs in DefaultFullAccessWithNotificationPolicy, which the preset policies use. Where it runs, the mail comes from quarantine@messaging.microsoft.com unless an admin picked another sender. The subject usually reads "Microsoft 365 security: You have messages in quarantine", and an admin can rewrite that too. It goes out every 4 hours, daily or weekly.
• Retention is 15 days by default. That is the default anti-spam policy. The Standard and Strict presets hold mail 30 days, and an admin can pick any value from 1 to 30. Mail held as malware or by a mail flow rule stays 30 days. Once a message expires, no one gets it back.

Microsoft's own quarantine guide covers the rest, so read it if releasing a message is all you came for.

Email quarantined by your own DMARC policy

Start here, because this is the one cause you fix alone. Read the policy your domain publishes today:

If the answer holds p=quarantine, you asked every receiver to treat your failing mail as suspicious. A message that fails alignment then lands in quarantine at Microsoft, or in the Junk Email folder, depending on one setting in the recipient's tenant. No one made a mistake at their end. Our DMARC checker reads the same record back with the policy spelled out, and the SPF checker counts the lookups behind it.

Microsoft acts on your policy through a switch called Honor DMARC record policy when the message is detected as spoof, and its settings reference lists it as on by default. Two actions sit under it. For p=quarantine, the choice is quarantine or the Junk Email folder, and the same reference gives Quarantine the message as the default. For p=reject, the two choices are quarantine and rejection, and Microsoft rejects by default.

Microsoft's DMARC article says the p=quarantine case goes to the Junk Email folder instead. The two pages disagree, so treat the tenant's setting as the answer. Either way the trigger is yours.

Fix alignment rather than the policy. One of SPF or DKIM has to pass for the domain in your visible From: address. In practice that means finishing the sending platform's domain setup and asking it for a custom return path. Reading dmarc=fail with p=REJECT walks the header field by field, and the alignment guide covers the platform settings that close the gap.

Dropping to p=none stops the holds once resolvers pick up the edit. RFC 7489 words that policy as a request for no specific action, so it also gives up the protection you published the record for. I would fix the sender and leave the policy where it is.

Aggregate reports are the only view a sender gets

You cannot see the recipient's quarantine and you never will. The nearest thing is a report you can ask for today. Microsoft sends DMARC aggregate reports for domains whose MX record points straight at Microsoft 365, to whatever address the rua= tag names. It sends no forensic reports, whatever your ruf= tag says.

An aggregate report counts messages per sending IP, says whether each one aligned, and records what the receiver did with them. When your own policy caused the hold, the host behind that message shows up in the next report as a failing source, with a count beside it. A spam or bulk verdict leaves no such mark, because that message passed DMARC on its way into quarantine. Publish a rua= tag if you have none:

A receiver writes one report a day, as XML, and two outside services read it for you at no cost. Cloudflare's DMARC Management takes the reports on any Cloudflare plan, provided the domain's nameservers sit at Cloudflare. Postmark's DMARC Digests work for a domain hosted anywhere and mail one summary a week. When I last checked, the free version listed 10 sources with 5 IP addresses each and 7 days of history, and $14 a month per domain lifted those limits.

Neither service can see inside the recipient's tenant, and neither can we. What all three hand you is the list of your own sources that fail alignment, which is the half of the problem you can act on. Reading a report by hand covers the fields that matter if you would rather open the XML yourself.

DomainCanary is our product, and this paragraph is the ad. Pro costs $19 a month for 10 domains. It mails you the day a report first names a source your domain has never used, when that source failed, and the day a sender in your history stops passing. The weekly digest lists every host that sent as you and which of them aligned, and the domains sharing one address arrive as a single email. A settings checkbox keeps a week with nothing to act on off your inbox and records it on the dashboard. We hold each source's history for at least 12 months, on the free plan as well as the paid ones. Your first domain is free, and the alert on the next failing source comes with Pro.

Microsoft's verdicts, and which ones hold mail

Your own policy is one path into quarantine. The recipient's filters are the other. What each verdict does depends on which policy their tenant runs, and Microsoft's settings reference lists these defaults. In the two tables below, Junk means their Junk Email folder, and the three columns are the default anti-spam policy, the Standard preset and the Strict preset. Bulk means mail at or above the tenant's own complaint level.

Spam, high confidence spam and bulk sit on one scale.

Verdict	Default	Standard	Strict
Spam	Junk	Junk	Quarantine
High confidence spam	Junk	Quarantine	Quarantine
Bulk	Junk	Junk	Quarantine

Phishing and spoofing run on a second scale.

Verdict	Default	Standard	Strict
Phishing	Junk	Quarantine	Quarantine
High confidence phishing	Quarantine	Quarantine	Quarantine
Blocked spoofed sender	Junk	Junk	Quarantine

The phishing row carries two defaults. Microsoft sets it to Junk in the default anti-spam policy and in new policies built in PowerShell, and to Quarantine message in a new anti-spam policy built in the Defender portal. High confidence phishing is the verdict no one turns off: "Malware and high-confidence phishing messages are always quarantined to protect the service."

So the same message sent to two companies gets two outcomes. At a tenant on default settings it reaches the Junk Email folder, where the recipient may still find it. At a tenant on the Strict preset it goes to quarantine, where they see it only if notifications are on.

Ask for the headers and the quarantine reason

The evidence you need sits in their mailbox and their admin console. Ask for both, in one message, before you change any DNS.

1. The full message headers. A recipient can read these for most verdicts, under View message headers in the More menu on the Defender quarantine page. Malware and high confidence phishing are admin-only, so those come from their admin. The Authentication-Results: line names which check failed and what Microsoft did about it, in the form dmarc=fail action=quarantine header.from=example.com. Reading dmarc=fail with p=REJECT explains each field on that line.
2. The quarantine reason. The X-Forefront-Antispam-Report: header carries a CAT: field, and that value names the verdict better than the word "quarantined". Their admin sees the same verdict in the Quarantine reason column.

Microsoft documents these CAT: values, among others.

Value	Verdict
SPM	Spam
HSPM	High confidence spam
BULK	Bulk
PHSH	Phishing
HPHSH or HPHISH	High confidence phishing
SPOOF	Spoofing
MALW	Malware
FTBP	Common attachments filter

Two reason codes sit next to the DMARC line. compauth=fail reason=000 means the message failed DMARC and your published policy is p=quarantine or p=reject. Reason 001 points at implicit authentication instead. Your domain published no authentication records, or it published a weaker failure policy: SPF ~all or ?all, or p=none.

What you fix, and what only their admin can release

Split the work before you spend a day on the wrong half.

What you own

• Alignment. Getting SPF or DKIM to pass for your From: domain closes the DMARC cause, and the section above has the fix. It also drops the question mark Outlook puts on your sender photo. Outlook adds that mark when a message passes neither check and fails DMARC or composite authentication as well.
• Content and list hygiene. A spam or bulk verdict judges the message and the sending history behind it. Correct records do not overrule it.
• The attachment. A malware or common attachments filter verdict is about the file, not the domain.

What their admin owns

• Releasing the held message. No one outside the tenant can do this.
• Allow entries. Their admin can add your domain or the spoofed pair to the Tenant Allow/Block List. Microsoft calls that temporary, and an allow entry expires in 30 days.
• Reporting a false positive to Microsoft. An admin submits that straight from the quarantine page.
• Policy strictness. Whether their tenant runs default settings, Standard or Strict is their call, and it explains why one customer sees your mail and another does not.

Ask by phone or from a different address. A follow-up from the same system reaches the same quarantine.

Gmail sends it to Spam instead

Gmail has no quarantine for its own users. When a Gmail recipient says "quarantined", they nearly always mean the Spam folder. The message sits in their account and they can find it. Gmail sends you no notice about it.

Google Workspace does have an admin quarantine, and it works differently. An admin builds it from compliance rules, and Google states that recipients "are never notified when a message is quarantined". You hear about it only if the admin denies delivery and their setting sends the default reject message. Google holds that mail up to 30 days after sending and then deletes it.

When Gmail refuses a message outright you get a real bounce with a status code in it, and Message blocked covers reading that.

Retry once, then watch the reports

Fix the cause your evidence named, then send one message to an address you can check. Send it to a mailbox at the company that told you, if they will take one. Keep the batch queued until that one lands, and if it reaches the inbox the change took.

After that, the reports are the only thing that tells you whether the fix held at the companies that never wrote to you. They name every host sending as your domain and say which ones align, and they arrive whether or not anyone complains. Ask for them today, even if this message turned out to be a spam verdict you cannot control.