Research that shines a light on public email security
Cyber Lighthouse is FaultyPacket’s research on what public DNS shows about how organisations protect their email: DMARC policies and where DMARC reports are sent. Every figure has a date, a method and downloadable aggregate data, so anyone can check the totals. Domain-level data is available on request.
Illustration: the beam sweeps across dots that stand for domains. The dots are not real domains.
OCTOBER 2026 SNAPSHOT
What the 338-domain sample shows
A fixed list of 338 organisation domains (335 of them UK and EU), checked in public DNS on 31 October 2026. 336 domains returned an answer, so the figures below are out of 336.
61.9%208 of 336 domains published a DMARC policy of p=reject.
77.1%259 of 336 domains asked for DMARC reports to go to an address outside their own domain.
32.4%109 of 336 domains sent reports to an external address run by a US-headquartered organisation.
3.6%12 of 336 domains had no valid DMARC record.
Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026), checked with two public DNS resolvers. CC BY 4.0. Figures from the aggregate data (JSON).
What this does and does not show
Observation: a DMARC record shows the policy a domain publishes and where it asks for reports to be sent.
Not shown: contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation. These figures are observed routing, not a legal or compliance finding. No organisation in the 338-domain sample is named in this section, and appearing in the sample does not make anyone a FaultyPacket customer or partner. Separately verified public-DNS observations of named organisations are listed under Named observations from public DNS.
PUBLIC DNS OBSERVATIONS
Named observations from public DNS
These are dated checks of records anyone can look up in public DNS (DMARC, SPF, MTA-STS). We show the raw answer we got, when we first saw it, and when we last checked. A listed organisation is not a FaultyPacket customer or partner. A public-DNS observation is not a legal or compliance finding, and it does not mean wrongdoing.
Curious what public DNS shows for your own domain? Free check below.
AstraZenecaastrazeneca.comDMARC policy is p=none; SPF ends with ~allStill observed as of 2026-11-06 (Europe/London)
NF-0001
Observed: DMARC policy is p=none (monitoring only; receivers are not asked to quarantine or reject failing mail).
First seen: 2026-11-03 · Last checked: 2026-11-06 · Still observed as of 2026-11-06 (Europe/London)
Think a row is wrong, out of date, or incomplete? Email [email protected] or use support. We re-check public DNS and publish a dated correction. Organisations may also use this route as a right of reply; we will note a verified reply next to the row.
Wall of Change
When a later check shows a stronger published policy or record, we keep the original detection date and add when the change was observed. That is a DNS before→after note, not a claim that any law required the change, and not a claim that FaultyPacket caused the change.
No dated before→after changes are listed yet. When a later public-DNS check shows a stronger published policy for a named observation above, it will appear here with both dates.
RESEARCH AND DATA
Read the research
Detailed pages, with dates and method notes on each one.
For each domain in the fixed list, we asked two public DNS resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8) for its DMARC record, at no more than two queries per second. The policy is the p= tag of a single valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=; “external” means a host outside the domain and its subdomains.
The list is frozen: no domain is added, removed or swapped. No other records, web pages, contact details or personal data were collected. Queries ran on 31 October 2026 from 08:03 to 08:10 UK time.
Limits of this method
Public DNS shows what a domain publishes at the moment it is checked. It can change at any time. Whether a reporting company is US-, UK- or EU-headquartered comes from FaultyPacket’s provider list; a host that is not on the list counts as “headquarters not classified”. The full method note is on the research hub.
Updates and corrections
The same list is re-checked each month. The next refresh is due on or after 28 November 2026. If you think a figure is wrong, or an organisation in the sample wants to reply, email [email protected] or use support. We re-check the claim against public DNS and publish a dated correction where needed.
See what public DNS shows for your domain
The free scanner runs the same kind of public-DNS checks on one domain.
Opens the free scanner on the homepage. No account needed.