I occasionally check my personal email's Spam folder to make sure Gmail hasn't classified an important email as spam.

This morning, I found one.

Gmail showing the bookstore email in Spam with an unauthenticated-sender warning

It's from my daughter's school district, their bookstore, sending her the access codes and passwords for this term's digital textbooks. Straight to Spam, with a banner saying the sender can't be verified.

The district is doing more than most. They monitor their email domain, they moved to quarantine, which tells Gmail to set aside any mail claiming their name that can't prove it. Gmail did exactly that; most organizations never get this far.

But quarantine is only half the battle, and the unfinished half is where it turns on you.

In an organization, new senders appear constantly. The bookstore signs up for a service to send access codes. A new app gets added to send notifications to parents about early departures. A department buys a newsletter tool. Every one of those people is solving a problem in front of them, and none of them know that the domain is under enforcement and their mail needs to be authenticated first.

Under p=none, those emails would still land in the inbox. Under quarantine, they don't. Enforcement without monitoring means your own legitimate senders get filed as spam, and nobody finds out until parents start calling in September because their kids can't open a textbook.

The failing source was already sitting in the district's DMARC reports. Reading them just wasn't anyone's job.

At RefineEmail, we review our customers' DMARC reports daily. When a new sending source shows up and fails authentication, we get in touch and authenticate it, usually before anyone notices mail going missing. That's how you keep enforcement on without losing good email to the Spam folder.