Nearly 1 in 3 UK/EU organisation domains we checked send their DMARC reports to US-headquartered companies.
Your DMARC record says who receives a daily report on the mail sent in your name. Here is where those reports go, and a free tool to check your own domain in seconds.
Every day, mail providers send a report on the email sent in your organisation's name: which servers sent it, how much, and whether it passed checks. Your DMARC record decides where that report goes. Most teams set it once and never look again.
We looked. As of 31 October 2026 (October 2026 snapshot), in a fixed sample of 338 UK/EU organisation domains, 336 returned a DNS answer. Of those 336:
- 259 of 336 (77%) send DMARC aggregate reports to an outside address.
- 109 of 336 (32%) send them to organisations headquartered in the United States. A further 104 send them to external addresses whose headquarters we have not classified.
Why It Matters For UK And EU Teams
A DMARC report lists the IP addresses and services that send mail for your domain. Where it goes is a data-residency question. For teams working through GDPR Chapter V transfer assessments, Article 28 processor reviews or NIS2 Article 21 supplier checks, the public DNS record is often where that question shows up.
What the record does not show: the contracts, transfer safeguards or hosting region behind the address. So treat these numbers as a prompt to check your own record and your own transfer arrangements, not as a finding about any organisation. We name no one.
Check Your Own Domain, Free, In Your Browser
FaultyPacket is live today, 2 November 2026. The free SuperTool runs its checks in your browser; we do not store your results and you do not need an account.
- See where your DMARC reports go, and whether that address is inside or outside your organisation.
- Get a clear pass/fail view of SPF, DMARC, MTA-STS and more, plus a copy-ready list of DNS changes and a backup of your current records.
- Download a timestamped evidence record (PDF + JSON with a SHA-256 hash) of exactly what public DNS showed when you scanned.
Run it now: faultypacket.co.uk/
If You Want More
One-off packs from £5 to £39. No subscriptions, no accounts, no data held by us. The NIS2, DMARC and bundle packs include a one-page management summary for a board or DPO pack.
- Fix packs for DMARC, NIS2 and Cyber Essentials email/domain checks.
- The Local RUA Workbench (£15): read your DMARC reports fully offline. Nothing leaves your device.
- An agency pack for checking client domains you are authorised to scan, with white-label reports.
For Journalists And Researchers
Full method, aggregate JSON/CSV and a 60-second guide to verifying any number yourself with dig: faultypacket.co.uk/research. Corrections and right of reply are welcome.
How We Work
This is public-DNS research, not consultancy or legal advice. We do not collect data we do not need, we do not run accounts, and we do not name and shame. We publish what public DNS shows, with the date and method, so anyone can check it.
Check your domain: faultypacket.co.uk/