# DMARC record history

DMARCwise normally scans your domains every **3 hours** to detect changes in the DMARC record. Scans are more frequent during setup and while a hosted DMARC change has just been published.

To view the record history, open a domain and select **DMARC** → **History**.

![DMARC record history](#docs/images/dmarc-record-history.png)

The timeline highlights record changes, record counts when more than one record was found, and switches to or from hosted DMARC.

Select a **validation issues** badge to review that version's errors and warnings, with explanations and suggested fixes. **Valid** means the displayed record passed syntax validation.

## DNS response details

DMARCwise scans your domain's authoritative nameservers directly instead of going through a public DNS resolver, to see what they publish and whether their answers agree. In the process, `CNAME` targets that delegate the record to another domain are followed.

To inspect these answers, open **DNS details** on a record to view the recorded observations and what each nameserver responded with. Note that consecutive identical scans share one **observation**, extending its duration.

![DNS response history of a DMARC record](#docs/images/dmarc-dns-responses.png)

This view helps you investigate the differences when nameservers disagree on a TXT or CNAME record: in this case, you'll see a **Nameservers disagree** warning with the differences highlighted in yellow, making it easy to compare the responses and locate the problem.

When a failure or a lookup limit prevented a complete result, you'll see a **Lookup incomplete** warning.

Not all nameservers are always queried:

- If a nameserver has only IPv6 addresses, these are not currently queried and the nameserver is marked as **skipped**.
- When a domain uses a recognized anycast DNS provider, only one nameserver is queried and the other ones are marked as **redundant**. Currently, the scanner detects Cloudflare, Amazon Route 53, Azure DNS, Google Cloud DNS, NS1, Bunny DNS, Gcore.
- When a domain doesn't exist and the lookup reaches the registry nameservers, only one nameserver is queried and the other ones are marked as **redundant**.

## Multiple records and nameserver disagreements

Publishing multiple DMARC records is an invalid configuration. In that situation, the timeline shows one **representative record**, which usually corresponds to the first record after sorting the DNS answer.

When nameservers disagree, the scanner tries to keep the timeline stable by keeping the current representative record if it still matches. The disagreement opens a [DMARC record health](/docs/alerts/rules#dmarc-record-health) alert, which stays open until the nameservers agree again.

When a lookup fails or is incomplete, the previous record is preserved and the lookup problem is shown in the DNS details section.

## Hosted DMARC

When [hosted DMARC](/docs/dmarc/hosted) is used, the record history page shows the new record only after it is discovered in DNS. In other words, the history always shows what your DNS publishes.

(Note that this applies only to records published after October 2026: before that date, an update to the hosted DMARC settings would appear in the record history immediately, even if not actually visible in DNS.)

![DMARC record history with a pending hosted DMARC change](#docs/images/dmarc-hosted-pending.png)

A DNS record discovered through DMARCwise's hosted DMARC is marked as such by the **Hosted DMARC** badge.