DNS guides

DMARCBreaks authentication

Multiple DMARC records: keep exactly one

Two v=DMARC1 records at _dmarc means receivers ignore DMARC for your domain. Merge them into one.

What it means

Receivers look up _dmarc.yourdomain and expect a single record starting with v=DMARC1. With more than one, the DMARC standard says to apply no policy at all.

It's usually a report service's setup record added next to the existing one.

Why it matters for cold email

Your domain behaves as if it had no DMARC: no policy, possibly no reports, and it fails the Gmail and Yahoo DMARC requirement.

How to fix it

  1. Copy both records.
  2. Combine them into one: one p= policy, and every report address in a single rua= separated by commas.
  3. Delete the extra record and re-check.

Your own reports plus a report service

Before

v=DMARC1; p=none; rua=mailto:[email protected]
v=DMARC1; p=none; rua=mailto:[email protected]

After

v=DMARC1; p=none; rua=mailto:[email protected],mailto:[email protected]

Questions

Can subdomains have their own DMARC record?

Yes, at _dmarc.sub.yourdomain. That's a different name, so it doesn't count as a duplicate.

Related problems

Last checked 2026-10-21 against RFC 7208 (SPF), RFC 6376 (DKIM) and RFC 7489 (DMARC). Full setup guide

Sending cold email? Outsquid re-checks these records for every sending domain every hour, so a broken one doesn't go unnoticed. How deliverability works