HighAuthentication · usually high
More than one DMARC record published
Multiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.
Check your own domain
What causes this
RFC 7489 permits exactly one DMARC record. When a receiver finds more than one TXT record starting with v=DMARC1 at the _dmarc name, the specification tells it to treat the domain as having no DMARC record at all. It does not pick one or merge them.
What it breaks
Your DMARC policy is not applied. Whatever enforcement level you configured — quarantine, reject — is ignored, and aggregate reports stop arriving.
How to fix it
Keep one record and delete the rest.
- List the DMARC records currently published at _dmarc.
- Decide which policy is correct — usually the more recently edited, stricter one.
- Delete every other TXT record at _dmarc that begins with v=DMARC1.
- Re-check to confirm exactly one record is returned.
Specification: RFC 7489 — DMARC
Related problems
- No DKIM key found at the selectors we checkedWe probed the selectors used by common providers and found no DKIM record.
- DKIM record is malformedThe record at this selector is not a valid DKIM key record.
- DKIM key is shorter than 1024 bitsThe RSA key is too short to be considered secure and some receivers reject it.
- No DMARC record foundThere is no DMARC policy at _dmarc for this domain.
- DMARC record contains a syntax errorA tag in the DMARC record is malformed, which can invalidate the whole policy.