DNSVerdictAll toolsGuidesHow it works

Multiple DMARC records: why none applies and how to merge

Published · Updated

If _dmarc.example.com returns more than one DMARC record, receivers discard all of them and your domain has no DMARC policy, whatever each record says. RFC 9989 (DMARCbis) states that when “multiple DMARC Policy Records are returned for a single target, they are all discarded” (§4.10). The legacy RFC 7489 §6.6.3 ends policy discovery in the same way. The fix is to keep one TXT record at _dmarc, move the tags you need into it, and delete the rest. Run the DMARC checker before and after.

How duplicates appear

Most duplicates are added by hand. A new email service tells you to “add this DMARC record”, and you create a second TXT record instead of editing the first. Other common sources are a DNS migration where old and new records were both imported, and a DNS panel that adds the record for you while a copy still exists from a previous setup.

SituationWhat you see in DNSWhat receivers do
Two records, both validTwo v=DMARC1 TXT values at _dmarcDiscard both, no policy
One valid, one not starting with v=DMARC1 (typo in the version tag)One good value, one broken valueThe broken one is discarded first (§4.10), so the good one may still apply
Valid record at _dmarc.example.com and another at example.comDifferent namesNo conflict; the second one is not a DMARC record
One record split into two quoted stringsOne TXT record with two stringsStrings are joined; this is a single record

The last row matters because a long record is often shown as "v=DMARC1; p=none; " "rua=mailto:...". Those are two strings in one record and are fine. Two separate rows in the panel are the problem.

Find them

Query the TXT records of _dmarc.example.com with the DNS lookup and count the values starting with v=DMARC1. Ask a few resolvers, because during a change one resolver can still serve a cached older record. The DMARC checker flags a domain with more than one record.

Merge them

Decide the tag values first; the receiver cannot merge for you.

  1. Policy p. Take the stricter value only if your reports show all legitimate mail passes. If unsure, use the weaker one and tighten later. See Moving from p=none to quarantine and reject.
  2. Report addresses rua (and ruf). Combine into one comma-separated list. Every service that wanted its own record usually only wanted its address in rua.
  3. Alignment adkim / aspf. Keep the default relaxed unless you have a reason.
  4. Subdomain tags sp, np. Keep the values you actually set. RFC 9989 §4.7 defines np for non-existent subdomains.
  5. Delete every other TXT value at _dmarc.

Before, two records:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:reports@monitor.example.net"

After, one record:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com,mailto:reports@monitor.example.net"

If monitor.example.net is a different domain from example.com, it must publish an authorization record or its reports will not be delivered; see DMARC reports explained.

Trade-offs and cautions

Removing the duplicates turns DMARC on for the first time. That is intended, but if one of the deleted records said p=none and another said p=reject, the combined record changes behaviour from “no policy” to whichever value you keep. A domain with no working record has been delivering mail with no DMARC enforcement, so check your aggregate reports for unaligned senders before choosing quarantine or reject. For tag syntax, see DMARC syntax errors, and for setup from scratch How to set up a DMARC record.

DNS caching delays the effect. Receivers keep the old answer for the TTL, so the duplicate can still be in effect for up to an hour with a TTL of 3600. A lower TTL beforehand shortens this.

FAQ

Does the first record win? No. There is no ordering rule. When more than one record is returned, none is used.

Can I keep one record for the domain and a different one for a subdomain? Yes. A record at _dmarc.mail.example.com is a separate name. Only duplicates at the same name conflict.

Did the multiple records stop my mail? Not directly. With no policy applied, receivers fall back to their own handling, and your mail is checked as if you had no DMARC record. Mail that fails SPF and DKIM is judged on local rules, not on your policy.

Sources

Tools used

DMARC Record CheckerDNS Lookup