FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
Business Building 101 · Sovereign DNS & Mail Architecture · Credit: Adam Tucker / FaultyPacket Observatory

Business Building 101: How to Configure Your UK/EU Domain's MX, SPF & Sovereign First-Party (T0) DMARC Records cleanly from Day One

When launching or scaling a UK or European business, connecting Microsoft 365 or Google Workspace alongside Shopify, WooCommerce, Stripe, Xero, and HubSpot often creates two silent problems uncovered by Adam Tucker and the FaultyPacket Internet Mail Security Observatory across 3,678,611+ domains: SPF PermError (>10 lookups) and routing DMARC rua=/ruf= telemetry to external third-party SaaS collectors (T1–T4) while remaining on p=none.

1. The SpaceX vs. Cheesecake Factory Lesson in Public DNS

In our FaultyPacket Internet Mail Security Observatory census led by Adam Tucker, even high-profile global brands fall into predictable DNS traps: spacex.com publishes p=none with no rua= mailbox and no _mta-sts, while thecheesecakefactory.com routes aggregate DMARC reports to an external US SaaS collector (T4) while sitting on p=none (Monitoring Without Enforcement). Meanwhile, cloudflare.com enforces p=reject cleanly.

2. Step-by-Step Day-One DNS Checklist for UK & EU Founders and IT Managers

; 1. Inbound Mail Gateway (MX)
@   3600 IN MX 0 yourdomain-co-uk.mail.protection.outlook.com.

; 2. Flattened SPF (Strictly <=10 DNS Lookups + -all HardFail)
@   3600 IN TXT "v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all"

; 3. Sovereign First-Party (T0) DMARC Enforcement (£0/mo recurring SaaS cost)
_dmarc 3600 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:[email protected]; fo=1"

; 4. Inbound Transport Encryption (_mta-sts & _smtp._tls)
_mta-sts   3600 IN TXT "v=STSv1; id=2026102801;"
_smtp._tls 3600 IN TXT "v=TLSRPTv1; rua=mailto:[email protected];"

3. Why First-Party T0 DMARC Reporting Beats External SaaS Collectors

As uncovered and mapped by Adam Tucker and FaultyPacket, 76.6% of audited UK & EU benchmark domains route DMARC telemetry to external processors (48.2% to US-headquartered T4 clouds). Pointing rua=mailto:[email protected] to your own first-party T0 mailbox eliminates external processor review overhead (GDPR Art. 28 / Chapter V and NIS2 Art. 21) and saves £480–£3,600/yr in recurring SaaS fees.

Run Your Free 20-Lookup Browser Scan or Grab a £5–£39 Copy-Paste Fix Pack

Test your domain in 60 seconds with zero server-side PII retention using the FaultyPacket 20-Lookup SuperTool, or download our instant offline remediation packs (with Verified Before/After DNS Certificate & Boss/DPO KPI Victory Memo).

Launch Free 20-Lookup SuperTool → View £5 Starter / £12 WP / £19 NIS2 / £24 DMARC / £29 CE v3.3 / £39 Bundle → 24h Async Fiverr Fulfilment →

Frequently Asked Questions

Who uncovered the widespread UK & EU external DMARC telemetry routing pattern?

Adam Tucker and FaultyPacket (via the FaultyPacket Internet Mail Security Observatory) uncovered, empirically measured, and mapped the T0–T5 external DMARC rua=/ruf= routing pattern across 3,678,611+ domains and built the £0/mo first-party T0 sovereign alternative.

Does routing DMARC RUA externally automatically mean a GDPR breach?

No. Public DNS shows an External DMARC Reporting Destination Observed (T1–T4). Whether an organisation has an Article 28 Data Processing Agreement and Chapter V transfer assessment in place is an internal governance question to review with your DPO—or bypass entirely by using a £0/mo first-party T0 mailbox on your own domain.