Two DMARC records is worse than none

If your domain publishes two DMARC records, it has no DMARC policy. Not a merged one, not the first one, not the stricter one. None.

RFC 7489 is explicit: a receiver that finds more than one DMARC record for a domain treats the result as if no record were published.

Why this is worse than not having one

A domain with no DMARC record is honestly unprotected, and anyone checking can see it. A domain with two looks protected. It passes a glance at your DNS. Someone on your team ticked it off a launch checklist. And you get no aggregate reports, so the mechanism that would have told you something is wrong is the exact thing that stopped working.

How it happens

Almost always the same way: two vendors, each with correct instructions.

Your email provider tells you to add a DMARC record. Later a marketing platform, a helpdesk or a website builder tells you the same thing. Both instructions are right on their own. Neither tells you to check whether one already exists, because from where they stand there is no way to know.

Then it sits there for months.

Checking

dig +short TXT _dmarc.yourcompany.com

You want exactly one line beginning v=DMARC1. Two lines is the problem. Zero means you have no DMARC, which is a different conversation.

Note that DMARC lives on the organisational domain. If you send from mail.yourcompany.com, the record still belongs at _dmarc.yourcompany.com.

Fixing it

Merge into one record. DMARC takes multiple reporting addresses, comma-separated:

v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.com,mailto:reports@vendor.example

Delete the other record entirely — do not leave it "just in case". Two records is the failure.

If the two disagreed on policy, take the weaker one and tighten later after reading reports. Going from an accidental no-policy straight to p=reject will find every system quietly sending as your domain, all at once, in production.