FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

CAA Record Setup: Restrict Which CAs Can Issue Your Certificates

The short answer (what's causing it)

Without a CAA record, any publicly trusted CA may issue a certificate for your domain. CAA (RFC 8659) lets you list the CAs you actually use.

Step-by-step fix

  1. List every CA you use (website, mail, CDN, MTA-STS host).
  2. Publish one issue line per CA; add issuewild if you use wildcards.
  3. Optionally add iodef for violation reports.
  4. Scan free to confirm.

Record examples (replace example.co.uk with your domain)

example.co.uk. CAA 0 issue "letsencrypt.org"
example.co.uk. CAA 0 issue "sectigo.com"
example.co.uk. CAA 0 iodef "mailto:[email protected]"

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: CAA.

Scan my domain free (20-check SuperTool) → £19 NIS2, DORA & ISO 27001 Supplier Posture Bulk Auditor Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Will CAA break my CDN?

It can if the CDN's CA isn't listed — check your provider's docs.

Do subdomains inherit CAA?

Yes, CAs climb the tree until they find a record.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.