More than one DMARC record published
What this check looks for
Two or more DMARC records exist at the same name. The rules tell receivers to ignore all of them, so your domain effectively has no DMARC policy.
Why it matters
You have a policy configured and none of it is in force — the worst kind of misconfiguration, because everything looks set up.
When the check passes, your report says: “Exactly one DMARC record is published”.
What it costs your score
When this check fails it removes 20 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- email-auth.dmarc · 40
- Category
- Email authentication
- Module
- Email dmarc
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Keep one DMARC record and delete the rest.
With more than one record, receivers apply no DMARC policy at all.
Decide which policy and report addresses you want; merge the rua addresses into one record if both were wanted.
Delete the other
_dmarcTXT records.
How to confirm it worked
dig +short TXT _dmarc.‹domain› | grep -c v=DMARC1 — expect 1
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹record count› TXT records starting v=DMARC1 were returned for _dmarc.‹domain›. RFC 9989 §4.10.1 states that if more than one record remains after filtering, the domain is treated as having no DMARC record at all.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email dmarc checks
- DMARC reports are sent to an unauthorised external domain
- DMARC requests forensic reports (ruf)
- Subdomain has no DMARC record and inherits the parent policy
- No DMARC record published
- DMARC record requests no aggregate reports
- DMARC record still carries a pct tag
- DMARC policy is p=none (monitor only)
- Subdomains are exempt from an enforcing DMARC policy
- DMARC record has a syntax error
- DMARC is in test mode, so the policy is not applied