dotvitals

Two TXT records of the same kind are published at one name

MediumConfirmedQuick windns.records.duplicate-txt-family

What this check looks for

There are two records of the same type where there should be one. Software that reads them is required to treat that as an error and ignore both, so the feature they configure stops working entirely.

Why it matters

Duplicated policy records are one of the commonest self-inflicted outages there is: SPF, DMARC and DKIM all specify that more than one record means "permanent error", and a permanent error is failure, not fallback.

When the check passes, your report says: “Each kind of TXT record is published exactly once”.

What it costs your score

When this check fails it removes 6 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.

It shares the dns.records.txt family ceiling of 12 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
warn
Deduction
6 points
Family cap
dns.records.txt · 12
Category
DNS
Module
Dns records
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Merge the duplicates into a single record and delete the rest.

Two records of one kind is a permanent error for every reader, not a fallback.

  1. List the duplicated records and decide which values must survive — usually all of them, merged into one.

  2. Publish one combined record.

  3. Delete every other record of that kind at the same name.

How to confirm it worked

  • dig +short TXT ‹domain› — expect exactly one record per version tag

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

More than one TXT record at ‹domain› carries the same version tag: ‹family list›. RFC 7208 §4.5 (SPF) and RFC 9989 §5.6.3 (DMARC, which replaced RFC 7489 in May 2026) both require the reader to abort when it finds two. This usually happens when a record is added by a new provider without deleting the old one, or when a control panel appends rather than replaces. The email modules report the same fault for their own record types with the specific consequences; this rule exists so the DNS lookup page reports it too.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the dns records checkerBuild the fix

Other dns records checks