ProofPoint shows end users DMARC failed emails when they're classified as spam!
By default spam quarantine has higher precedence than DMARC, so end users get these in their digest. Users do not see that the sender failed DMARC and can release it.

The (undocumented) solution is to contact ProofPoint support to set DMARC Quarantine at a higher precedent.

Why is this not the default? When would you want DMARC failed Spam in your digest? 
#proofpoint #dmarc #baddefaults