You moved your domain’s settings to a new email provider or DNS host. The website works. The invoices still seem to go out. Then you notice two lines starting with v=DMARC1 in the DNS panel. Which one protects your customers from a fake invoice?

Receivers discard both records. If your domain publishes two DMARC TXT records at _dmarc, the current standard says to discard them all, so the rule you thought you published is gone. To fix it, keep one record with the policy you chose, delete the extra, and confirm with dig TXT _dmarc.example.com +short.

DMARC is the domain rule that tells receiving inboxes how to treat mail claiming to be from you. After discarding, a receiver uses a parent domain’s record if one exists (for a subdomain, usually your main domain’s) and otherwise acts as if you have no DMARC rule.

How to check for multiple DMARC records

DNS is the public settings directory for your domain. A TXT record is one text entry in that directory. In your DNS provider, open DNS / Records and filter for TXT records whose Name is _dmarc (some panels display the full name _dmarc.example.com). Replace example.com below with your own domain.

If you have a terminal, check what the public directory returns. No terminal? Counting the lines in your DNS panel is enough, and you can skip the dig commands.

dig TXT _dmarc.example.com +short

You might see:

"v=DMARC1; p=reject; rua=mailto:reports@example.com"
"v=DMARC1; p=none; rua=mailto:reports@example.com"

These are two separate records, not one long record shown on two lines. p=reject signals that you want failing mail rejected; p=none asks receivers only to monitor, not to block. rua= is where summary reports are sent. A single record displayed in multiple quoted chunks is different: some DNS systems split one long TXT value into chunks.

Which duplicate DMARC record to keep

Keep the line your email provider’s setup page tells you to use. If you are unsure, ask whoever set up your email before you delete anything. First take a screenshot or copy both complete values, then identify who added each line: the old DNS provider, a new email service, or a teammate. Check your earlier DNS export and the email service’s setup instructions. If one line has your current report address and the other points to an inbox you no longer own, do not blindly keep the old address. If one line says p=reject and the other p=none, do not keep one just because it sounds more secure.

Keep one TXT record at _dmarc with the policy and reporting destination your team actually chose. Delete only the extra DMARC record. Do not delete other TXT records or DKIM keys (the email signatures used by your sending services).

Don’t use this fix to switch on blocking. For that, follow the safe move from monitoring to reject after checking every sender.

How to verify only one DMARC record remains

Run the same lookup again, including from another network or resolver if your provider’s change has not appeared yet:

dig TXT _dmarc.example.com +short
dig @1.1.1.1 TXT _dmarc.example.com +short

Wait for DNS caches to refresh if you still see both values. The goal is one TXT record beginning v=DMARC1 at that name, with the value you selected. A green check in one DNS panel is not enough if the public query still returns two.

If someone technical is available, send an invoice or password-reset test email to a mailbox you control and use Show original / View headers to inspect the authentication results. Check for a DMARC pass, and verify the customer-visible From domain matches the domain you just fixed. If the test fails after you kept an enforcing policy, stop further policy changes; compare with the saved records and check why SPF can pass while DMARC fails.

Finally, check that your summary reports resume arriving at the address in rua=. If they stay absent, work through the report-gap checklist.

A duplicate can come back: the next DNS move or a new email tool can quietly add a second record. DMARC Guardian re-checks your DNS every hour and puts a critical flag on the bell in your dashboard when it finds two. It does not email you and it cannot fix the record for you.

See a critical flag within an hour if a second DMARC record appears →