Several DMARC records are published at _dmarc
What it is
Two or more DMARC records are published at the _dmarc name. Receivers do not pick one. According to the standard (RFC 9989, section 4.10) they apply none of them, so the domain has no DMARC protection.
We only looked at public DNS. We can see what is published, not how each receiver ends up handling it.
Do not confuse this with a single record that your DNS panel splits into several quoted strings. That is still one record. This finding is about separate TXT records.
Why it’s a problem
The result is the same as if DMARC were missing. Nobody enforces your policy and no reports arrive.
- Anyone can send mail with your domain in the From address and the receiver has no reason to drop it.
- The usual cause is quiet: an old record stayed after a mail provider change and a new setup wizard added a second one.
- The record can belong to a parent domain rather than this host. If the command below shows nothing for your host, run it for the parent domain too (for
www.example.czthat is_dmarc.example.cz).
How to fix it
Keep a single TXT record and delete the others.
1. List what is published
dig +short TXT _dmarc.example.cz2. Merge them into one
Pick the policy you actually want and unify the report addresses (rua). If you are unsure, start soft and tighten the policy after you have read the reports:
v=DMARC1; p=none; rua=mailto:dmarc@example.cz3. Delete the rest
In your DNS panel remove every other TXT record at _dmarc. The change shows once the TTL expires. Then run the command above again: it should return exactly one line.