We Uncovered the UK & EU GDPR / NIS2 _dmarc Compliance Flaw—And We Came to Fix It.
Through the FaultyPacket Internet Mail Security Observatory (auditing 3,678,611+ global, UK & EU domains alongside our 338-domain 10-sector benchmark via Cloudflare 1.1.1.1), we documented a massive operational and governance blind spot in public DNS: 76.6% (259 domains) route their daily DMARC email telemetry to third-party SaaS processors, 48.2% (163 domains) stream it straight into US-headquartered clouds subject to the US CLOUD Act (triggering GDPR Article 28 / Chapter V processor & transfer assessment overhead and NIS2 Article 21(2)(d) supply-chain scrutiny), while 252,291+ domains (13.80% of DMARC domains, including 36 household UK/EU brands) sit in Monitoring Without Enforcement (p=none + external third-party RUA).
We are the engineers who found the flaw—and built the sovereign, zero-subscription cure. Alongside our instant browser diagnostics and one-off fix packs for DMARC, SPF, MTA-STS, WordPress/WooCommerce, PHP2Shell (CVE-2026-109618), and our Cyber Essentials v3.3 Prep + Email/Domain Security Gap Pack (“Danzell”), we help UK & European teams take back full sovereignty of their DNS and security posture from £5 GBP.
1. The Compliance Flaw We Found — And Why Legacy SaaS Can’t Hotfix It
For years, UK and European IT teams were told by US DMARC vendors (MxToolBox, DMARCly, Valimail, dmarcian, Proofpoint, EasyDMARC, SendGrid) to point their public _dmarc TXT record’s rua=mailto: and ruf=mailto: tags at the vendor’s multi-tenant cloud. Nobody stopped to ask what happens when every Google, Microsoft 365, and Yahoo mail server on Earth emails daily XML sender inventories and unredacted forensic headers across the Atlantic:
1. GDPR Art. 44 & US CLOUD Act Conflict76.6% Exposed
US-incorporated SaaS vendors cannot “git-push” their corporate headquarters out of US jurisdiction (18 U.S.C. § 2713). Streaming rua= and forensic ruf= telemetry to external US processors creates an immediate Chapter V cross-border transfer and Art. 28 sub-processor exposure.
2. The p=none Subscription Trap36 Household Brands
Our live 1.1.1.1 audit caught 36 major UK & EU brands paying recurring SaaS subscriptions to external DMARC dashboards while leaving their live policy on p=none—meaning spoofers still sail straight into customer inboxes.
3. Authoritative DNS Lock-InManual Edit Required
No third-party SaaS vendor has write access to your Cloudflare, Route 53, or Azure DNS zone. Since your own engineer has to edit the _dmarc TXT record anyway, pointing rua=mailto:[email protected] to your own sovereign UK/EU mailbox takes the exact same 60 seconds and costs £0/month forever.
4. Complete Stack Fixes Beyond DMARC£5–£39 One-Off
We didn’t stop at DMARC data residency. We built browser-local scanners and drop-in remediation packs for every major pain point UK & EU sysadmins face: SPF 10-lookup flattening, MTA-STS, WordPress/WooCommerce wp_mail & REST lockdown, PHP2Shell (CVE-2026-109618), Cyber Essentials v3.3 (“Danzell”), and NIS2/DORA 1,000-supplier auditing.
“Souls live and breathe, and packets move. We’re FaultyPacket—not faulty goods.”
Hi, I’m Adam Tucker. Over the past 23+ years leading IT and security infrastructure across 6 countries (the UK, Ireland, Denmark, Finland, Norway, and Sweden)—backed by 9 years of commercial software engineering—I’ve sat on the buyer’s side of the table for every kind of audit: Microsoft 365, Entra ID, Intune, Windows Autopilot, Palo Alto firewalls, Cyber Essentials, ISO 27001, GDPR, and NIS2.
I started FaultyPacket because I got tired of two things: watching businesses get fleeced £1,500+ in consultancy retainers (or $1,200/yr in US SaaS subscriptions) for configurations that take 20 minutes when you have the right blueprint—and watching those same US SaaS tools quietly create new GDPR and NIS2 telemetry leaks for UK and European companies.
Every scanner and Chrome MV3 extension we publish is 100% free forever with zero server-side PII harvesting. When you want the ready-to-paste DNS zone files, offline Python/PowerShell auditors, WordPress MU-plugins, or IASME v3.3 evidence templates, you can grab them for a one-off £5–£39 GBP—or book our $15–$175 24-hour Done-For-You engineering service on Fiverr (@faultypacket) with zero sales calls.
How Our Ecosystem Fits Together: Creator (Sphud) → Lab (FaultyPacket) → Observatory → Tools
We preserve authentic engineering lineage and separate our creator identity, security engineering lab, empirical research observatory, and standalone practitioner products:
1. Creator & Experimental Lab: Sphud (Sphud ✓)Creator Lineage
Adam Tucker’s original creator identity and verified experimental engineering lab (Sphud ✓, 4.4K followers)—the umbrella studio where independent software, infrastructure automation, and applied research originate.
2. Security & Compliance Brand: FaultyPacket Security LabUK SecOps Lab
Our dedicated UK & European DNS, email authentication, WordPress/WooCommerce, and regulatory compliance engineering practice (faultypacket.co.uk · @faultypacket, 16.6K followers).
3. Flagship Empirical Project: Internet Mail Security Observatory3,678,611+ Domains
Our reproducible 10-million-domain empirical DNS census, longitudinal Wall of Change tracker, and 338-domain UK/EU regulated benchmark documenting DMARC p=none drift and third-party rua=/ruf= telemetry exposure.
4. Standalone Products, Extensions & Async Fixes£5–£39 / $15+
100% client-side browser scanners, official Chrome Web Store MV3 extensions (Security & DNS Inspector & Clean Table CSV Exporter), one-off £5–£39 offline remediation ZIP packs, and 24-hour zero-call async Fiverr engineering gigs.
📘 FaultyPacket Internet Mail Security Observatory — Methodology, Scope & Correction Policy (v2.2 · Oct 2026)Reproducible Public DNS Evidence
Empirical Observation vs. Legal Assessment: All statistics published by the FaultyPacket Internet Mail Security Observatory (including our 338-Domain Regulated Benchmark and our rolling 10-Million-Domain Census, currently at 3,678,611+ domains audited) are derived from live, reproducible public DNS queries (_dmarc, SPF, MX, _mta-sts, _smtp._tls, CAA, and DNSSEC) via Cloudflare 1.1.1.1 and multi-resolver verification. Lookups that return network timeouts or SERVFAIL are classified as UNASSESSED and excluded from percentage denominators. Routing DMARC reports to a third-party or US-headquartered vendor is a technical observation from public DNS (rua= / ruf=), not an automatic legal determination under GDPR Article 44 or NIS2 Article 21; organisations should review their own transfer mechanisms (such as DPF/SCCs and processor DPAs) or route reports directly to an internal UK/EU mailbox to eliminate third-party processor overhead altogether.
Live Re-Verification & Corrections: Any domain owner who updates their DNS records can verify their live posture immediately using the FaultyPacket 20-Lookup SuperTool or request a dataset refresh at [email protected]. Raw datasets: 10M Observatory Hub · 338-Domain Study JSON · 10M Observatory Live JSON.