Two TXT records of the same kind are published at one name
What this check looks for
There are two records of the same type where there should be one. Software that reads them is required to treat that as an error and ignore both, so the feature they configure stops working entirely.
Why it matters
Duplicated policy records are one of the commonest self-inflicted outages there is: SPF, DMARC and DKIM all specify that more than one record means "permanent error", and a permanent error is failure, not fallback.
When the check passes, your report says: “Each kind of TXT record is published exactly once”.
What it costs your score
When this check fails it removes 6 points from your DNS score, before the status, confidence and repeat multipliers are applied. DNS carries a weight of 10 in the overall score.
It shares the dns.records.txt family ceiling of 12 points: however many findings that family produces, together they cannot remove more than that from DNS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 6 points
- Family cap
- dns.records.txt · 12
- Category
- DNS
- Module
- Dns records
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Merge the duplicates into a single record and delete the rest.
Two records of one kind is a permanent error for every reader, not a fallback.
List the duplicated records and decide which values must survive — usually all of them, merged into one.
Publish one combined record.
Delete every other record of that kind at the same name.
How to confirm it worked
dig +short TXT ‹domain› — expect exactly one record per version tag
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
More than one TXT record at ‹domain› carries the same version tag: ‹family list›. RFC 7208 §4.5 (SPF) and RFC 9989 §5.6.3 (DMARC, which replaced RFC 7489 in May 2026) both require the reader to abort when it finds two. This usually happens when a record is added by a new provider without deleting the old one, or when a control panel appends rather than replaces. The email modules report the same fault for their own record types with the specific consequences; this rule exists so the DNS lookup page reports it too.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other dns records checks
- The domain has no IPv6 address
- The domain apex is a CNAME, which the DNS does not allow
- A CAA record marked critical uses a tag no authority understands
- CAA forbids every authority from issuing a certificate
- The CAA reporting address is not a usable URL
- No CAA record says which authorities may issue certificates
- The domain has no A or AAAA record
- Records are published with a very long TTL
- Records are published with a very short TTL
- A TXT record looks cut off at the 255-character limit
- A wildcard record answers for every subdomain