How do I use the DMARC Record Checker tool?

The DMARC Record Checker at Valid Email Checker reads the TXT record published at _dmarc.<your-domain>, parses every tag, and tells you the current policy plus any configuration issues. DMARC sits on top of SPF and DKIM and tells receivers what to do with mail that fails both — none, quarantine, or reject. Getting the policy right matters more than getting the record to exist.

Step by step

1. Open /dmarc-record-checker.
2. Enter your apex domain (e.g. example.com).
3. Click Check DMARC Record.
4. In under a second the panel below shows the raw TXT record, the parsed policy tags, and a status badge for the policy level (none, quarantine, or reject).

What the checker parses

• p= — main policy. none means monitor only; quarantine sends failing mail to spam; reject blocks it outright.
• sp= — subdomain policy. If absent, subdomains inherit p.
• pct= — percentage of failing mail the policy applies to (1-100). Useful for staged rollouts.
• rua= — aggregate report mailbox. Daily XML summaries land here.
• ruf= — forensic report mailbox. Per-message failure details (often disabled by receivers for privacy).
• fo= — forensic options. 0 reports both SPF+DKIM fail; 1 reports either fails; d/s report specific failures.
• aspf= and adkim= — alignment mode. r (relaxed) allows subdomains to match; s (strict) requires exact match.
• ri= — report interval in seconds. Usually 86400 (one report per day).

What "good" looks like

A production-grade DMARC record on an established domain looks something like:

v=DMARC1; p=reject; rua=mailto:dmarc@example.com; pct=100

p=reject and pct=100 mean every unauthenticated message claiming to be from your domain is rejected. rua= ensures you keep getting visibility through aggregate reports. If your record reads p=none and has been there for more than a few months without progressing, you are leaving spoof protection on the table — see the DMARC Record Generator for the recommended upgrade path.

When the record is missing or broken

No record at _dmarc.<your-domain> means receivers have no policy guidance and your domain is wide open to spoofing in theory (in practice, Gmail and Microsoft increasingly require DMARC for high-volume senders). If the checker returns "no record", use the generator to publish one starting at p=none and progress through quarantine to reject over weeks of monitoring.