FaultyPacket Logo FaultyPacket FREE TOOLS & AUDIT PACKS
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
STOP CLIENT INVOICES & QUOTES LANDING IN JUNK

Move from p=none to Strict DMARC p=reject, SPF & MTA-STS—Without Blocking a Single Real Business Email.

Gmail, Outlook, and Yahoo quietly quarantine domains stuck on p=none or over the 10-lookup SPF limit. Check your live DNS below in 3 seconds—then fix it yourself with our £5 Quick-Fix Launch Pack (or £24 Full Pack) or book a $15 24-hour Done-For-You fix on Fiverr.

Run Free Live Domain & CVE Triage Download Complete Remediation Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
FREE INTERACTIVE DIAGNOSTIC · LIVE CLOUDFLARE 1.1.1.1 DoH AUDITOR

Live Browser-Local SPF 10-Lookup Counter, DMARC & MTA-STS Scanner

Test any domain right here on this page with zero page hops. Queries public Cloudflare 1.1.1.1 DNS-over-HTTPS for RFC 7208 SPF lookup counts (≤10 limit & -all enforcement), DMARC policy (p=reject & rua= telemetry), MX resilience, _mta-sts TLS enforcement, _smtp._tls reporting, and CAA locks:

1. Why p=none Fails Security Audits & Bulk Sender Mandates

Publishing v=DMARC1; p=none; provides zero active protection against direct domain spoofing. Under Google, Yahoo, and Microsoft bulk-sender mandates, NIST SP 800-177, and UK NCSC / Cyber Essentials v3.3 ("Danzell") guidance, organizations must transition to enforced policies (p=quarantine or p=reject) paired with strict SPF (-all) and 2048-bit DKIM signing.

Test Your Domain's Live DMARC & SPF Score Free →

2. Staged Rollout Blueprint (Without Blocking Legitimate Business Email)

Never jump straight from no DMARC record to p=reject on a production domain with third-party senders (Microsoft 365, Google Workspace, Salesforce, HubSpot, SendGrid, Xero). Follow this 4-stage progression:

; Stage 1: Inventory & Telemetry (7–14 Days) _dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; fo=1; adkim=r; aspf=r;" ; Stage 2: Partial Quarantine Canary (25% -> 100%) _dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected];" ; Stage 3: Full Reject Enforcement + Strict Alignment _dmarc.example.com. IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]; adkim=s; aspf=s;"

3. Fixing the SPF 10-Lookup Limit (permerror) & Adding MTA-STS

Per RFC 7208 Section 4.6.4, an SPF record that triggers more than 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) returns a fatal permerror, causing receivers to treat legitimate mail as unauthenticated. Dedicate sub-domains (e.g. mail.example.com, billing.example.com) to third-party senders, remove redundant mx mechanisms, and terminate with -all.

Pair your DMARC policy with MTA-STS (_mta-sts TXT + /.well-known/mta-sts.txt) and TLS-RPT (_smtp._tls TXT) to prevent SMTP STARTTLS downgrade attacks without paying £300–£600/year ($380–$750/yr) for a recurring DMARC SaaS subscription.

Get the 10-Page Handbook, CLI Auditor & DNS Zone Templates — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
View Sample Executive HTML Audit Report →

Frequently Asked Questions

Do I need a monthly SaaS subscription to enforce DMARC p=reject?

No. DMARC, SPF, DKIM, MTA-STS, and TLS-RPT are open DNS and HTTPS standards (RFC 7489, RFC 7208, RFC 8461). Once your sending services are aligned and your DNS records are published, they work permanently in your own DNS zone with zero monthly fees.

How do I fix SPF Too Many DNS Lookups (limit of 10)?

Remove top-level include statements for inactive platforms, replace a and mx mechanisms with explicit ip4/ip6 CIDRs where static, and move bulk marketing or invoicing platforms onto dedicated subdomains so each subdomain gets its own 10-lookup budget.

FIX IT IN MINUTES (£5–£39) · OR USE OUR 100% FREE CHROME TOOLS

Deploy the Automated Fix in Minutes — Or Grab Our 100% Free Chrome Extensions

🛡️ Path A (For Teams & Audits — Paid ZIP Packs):

Need drop-in Nginx/Apache/IIS/Cloudflare configs, offline Python & PowerShell collectors, and board-ready HTML reports? Choose a standalone pack (£12 WP & WooCommerce Shield, £19 NIS2/DORA, £24 DMARC/PHP2Shell, £29 Cyber Essentials v3.3) or get all 4 in the £39 Complete 4-Pack Compliance & Web Shield Bundle (Save £45 / 54%).

DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
All 4 Packs Bundle — £39 (Save £45 vs buying all 4 separately)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
☕ Path B (100% Free Extensions & Diagnostics):

Both of our Chrome MV3 extensions are 100% Free Forever (zero paywall, zero telemetry). Download them below or fuel the Lab Fund:

Free Table Exporter MV3 (.zip) Free Security Inspector MV3 (.zip)
HONEST OPTIONS · FIX IT FREE VS. £5–£39 PACKS VS. $15 FIVERR FIX

Scanner Finding → Free DIY Fix → Paid Pack or 24h Done-For-You Mapping

Every FaultyPacket diagnostic separates what was observed publicly, the free DIY remediation step you can apply yourself immediately, the matching self-serve ZIP pack (£12–£39) or 24h Fiverr Done-For-You gig ($15–$175), and the exact evidence scope & exclusions. Looking for how we handle DNS transport failures? Open the Interactive Evidence Comparison Lab → or view our Sample Audit Report →.

1. Missing DMARC / SoftFail SPF / No MTA-STSEMAIL AUTH

Why It Matters: Unauthenticated senders can spoof executive domains or downgrade SMTP TLS.

Free DIY Fix: Publish _dmarc TXT "v=DMARC1; p=quarantine; rua=..." and flatten SPF to ≤10 lookups ending in -all.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (or $25–$95 Fiverr DMARC Gig).

Scope & Exclusions: Public DNS/TXT/MX & MTA-STS records only; excludes internal Exchange/Workspace tenant admin access.

2. WordPress wp_mail / REST / XML-RPC ExposureWP & WOO

Why It Matters: Unauthenticated user enumeration, XML-RPC brute-force amplifiers, and WooCommerce receipts landing in spam.

Free DIY Fix: Disable xmlrpc.php, filter /wp-json/wp/v2/users, and align SMTP DKIM/SPF headers.

Paid Pack / 24h DFY: £12 WP & WooCommerce Shield Pack (faultypacket-wp-shield.php MU-plugin) or $15–$55 Fiverr 24h Fix.

Scope & Exclusions: Zero wp-admin credentials required; drop-in MU-plugin + DNS records.

3. PHP2Shell (CVE-2026-109618 & -109619)RUNTIME / WAF

Why It Matters: Exposed PHP runtime banners, FastCGI/PHP-FPM env injection (CVE-2026-109618 & sibling CVE-2026-109619), and missing HSTS/CSP.

Free DIY Fix: Patch PHP runtime, set expose_php = Off, and lock FastCGI SCRIPT_FILENAME boundaries.

Paid Pack / 24h DFY: £24 DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack (Nginx/Apache/IIS/Cloudflare rules + IOC script) or $30–$110 Fiverr Gig.

Scope & Exclusions: Edge WAF/server config & passive header/IOC verification; non-intrusive (zero exploitation).

4. NIS2 Art. 21 / DORA & CE v3.3 ("Danzell") GapsGOVERNANCE

Why It Matters: Supply-chain DNS email posture blind spots and IASME Cyber Essentials v3.3 ("Danzell") assessment failures.

Free DIY Fix: Use our free browser NIS2 25-domain auditor & CE v3.3 readiness scorer with evidence-aware DoH checks.

Paid Pack / 24h DFY: £19 NIS2 Bulk Pack / £29 CE v3.3 Pack / £39 Complete 4-Pack Compliance & Web Shield Bundle (or $35–$175 Fiverr).

Scope & Exclusions: Public DNS posture score (0–100) & self-assessment templates; not an accredited certification body.

🔄 Opt-In Domain & WordPress Drift MonitoringDNS TXT VERIFIED

Want continuous checks after fixing your records? Pack and Fiverr buyers can enrol domains in our Opt-In Drift Monitor by publishing a read-only _faultypacket-verify.<domain> DNS TXT ownership token.

Zero-Spam Guarantee: Outbound drift alerts ([email protected]) are disabled by default and only fire when both explicit consent and _faultypacket-verify TXT ownership are verified and a baseline SPF/DMARC/MTA-STS/WP header drifts.

🏢 For Web Agencies & MSPs: Multi-Domain & White-Label ScorecardsMSP & AGENCY READY

Managing 10–250 client WordPress sites or Microsoft 365 domains? Our £39 Complete 4-Pack Compliance & Web Shield Bundle and Fiverr Pro Tiers include multi-domain batch auditing and White-Label Executive HTML Scorecards (--agency-name / --white-label) ready to hand directly to your clients.

Email [email protected] or order via Fiverr (@faultypacket) with your agency name and domain list.

GIG #1 SPOTLIGHT · 24H ASYNC DELIVERY (US$25 / US$35 / US$50) OR £24 INSTANT PACK
Zero Calls · Zero Server Logins · 24h Delivery

Need Done-For-You DMARC p=reject, SPF Flattening & 550-5.7.26 Remediation in 24 Hours?

Order our 100% asynchronous DNS & Email Authentication service on Fiverr (@faultypacket) with zero calls or server logins required, or download the self-service £24 UK Domain & DMARC Remediation Pack instantly:

🟢 Hire FaultyPacket on Fiverr — DMARC, SPF & MTA-STS Fix Pack (US$25 / US$35 / US$50) → ⬇ Buy Instant DMARC & SPF Pack — £24
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
View All 4 Live Fiverr Gigs (@faultypacket) ↗
TWO SIMPLE WAYS TO FIX IT · £5–£39 INSTANT ZIP OR $15+ DONE-FOR-YOU ON FIVERR 100% Transparent Pricing · Zero Calls Required
⚡ Option 1: Buy on This Website via PayPal (£12–£29 Single Pack · £39 Complete 4-Pack Compliance & Web Shield Bundle)

Instant 0-Second Self-Serve Template ZIP. You immediately download our unencrypted production scripts, MU-plugins, server configs, and templates, and you fill in your own domain name using our 3-minute Quick-Start guide. Lowest flat price because no custom engineer time is required.

🛠️ Option 2: Order on Fiverr ($15–$175 · Basic / Standard / Premium Tiers)

Custom “Done-For-You” 24h Engineering. Why Fiverr costs more: our engineers run a deep external server & DNS probe on your live domain(s) and custom-write every record and config file specifically for your domain, IPs, and mail/payment stack—ready to paste with zero editing. Includes a custom 0–100 Executive HTML Scorecard written for your company, multi-domain tiers (1–5 domains or 25–250 suppliers), live post-fix verification, and all 4 Packs (£84 value) free on Premium.

Gig #1 · Domain DMARC, SPF, DKIM & MTA-STS Audit + DNS Fix Pack£24 Self-Serve ZIP · US$25 / US$35 / US$50 Fiverr

Full RFC 7489/7208/8461 external audit (SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA) + Cloudflare/BIND/M365 DNS Fix ZIP (incl. Google/Yahoo 550 5.7.26 bulk-sender compliance).

⚡ £24 Website ZIP (Self-Serve): Instant download of generic DNS templates, 10-page PDF handbook & Python CLI scanner (you plug in your domain).
🛠️ US$25 / US$35 / US$50 Fiverr (Done-For-You): We audit 1 domain ($25), 3 domains + MTA-STS ($35), or 5 domains + Live Post-Fix Re-Scan + All 4 Packs ($50) & write your exact DNS records + custom Executive HTML Scorecard.
🛠️ Order Done-For-You Custom Audit on Fiverr (US$25 / US$35 / US$50) → ⚡ Or Buy Self-Serve Template ZIP — £24 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #2 · WP, WooCommerce & PHP2Shell Hardening£12 WP / £24 PHP ZIP · US$15 / US$30 / US$55 Fiverr

Zero-login WordPress/WooCommerce /wp-json/wp/v2/users, xmlrpc.php, PCI-DSS v4.0.1 CSP & wp_mail() 550-5.7.26 rescue + PHP2Shell (CVE-2026-109618) FastCGI/CGI lockdown, MU-plugins & Cloudflare WAF ZIP.

⚡ £12 WP Pack (or £24 PHP Pack) on Website (Self-Serve): Instant 11-file drop-in MU-plugin, Nginx/Apache, Cloudflare WAF & SMTP rescue ZIP (you drop onto your server).
🛠️ US$15 / US$30 / US$55 Fiverr (Done-For-You): We run a live external HTTP/DNS probe on your site, pre-fill your domain’s exact configs & custom Scorecard ($15 1-Site WP/Email · $30 Full WP + PHP2Shell Lockdown · $55 3-Site + Re-Scan + All 4 Packs).
🛠️ Order Done-For-You Custom Fix on Fiverr (US$15 / US$30 / US$55) → ⚡ Or Buy Self-Serve WP Shield ZIP — £12 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #3 · Cyber Essentials v3.3 (“Danzell”) & Entra ID Pre-Audit£29 Self-Serve ZIP · US$35 / US$55 / US$85 Fiverr

Mandatory April 2026 NCSC/IASME v3.3 gap analysis (cloud MFA anti-spoofing, passwordless readiness, 1-day leaver SLA, Device Code block) + offline Graph PowerShell collector & IASME model answers.

⚡ £29 Website ZIP (Self-Serve): Instant download of our offline Graph PowerShell collector, IASME v3.3 Editable Response Guidance & Templates & 1-Day Leaver SOP.
🛠️ US$35 / US$55 / US$85 Fiverr (Done-For-You): We run your external v3.3 boundary pre-audit ($35 1-Domain · $55 3-Domain + Custom Entra/MFA Plan · $85 5-Domain + Assessor Sign-Off Dossier + All 4 Packs) & write your custom Gap Report.
🛠️ Order Done-For-You Pre-Audit on Fiverr (US$35 / US$55 / US$85) → ⚡ Or Buy Self-Serve CE v3.3 Pack ZIP — £29 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee

Gig #4 · NIS2 Art. 21 & DORA 25–250 Supplier Bulk Security Audit£19 Self-Serve CLI · US$50 / US$95 / US$175 Fiverr

Automated non-intrusive posture audit of up to 25, 100, or 250 vendor domains + board-ready HTML Executive Dossier, risk-scored CSV register, 30-day vendor remediation notices & Python CLI scanner.

⚡ £19 Website ZIP (Self-Serve CLI): Instant download of our Python 3 Bulk Supplier CLI Scanner & CSV templates to run vendor scans yourself on your own machine.
🛠️ US$50 / US$95 / US$175 Fiverr (Done-For-You Managed Batch Audit): Send us your vendor list—we scan 25 ($50), 100 ($95), or 250 ($175) supplier domains for you & deliver a finished Art. 21/28 Board HTML Dossier, Risk-Scored CSV + All 4 Packs included.
🛠️ Order Done-For-You 25–250 Vendor Audit on Fiverr (US$50 / US$95 / US$175) → ⚡ Or Buy Self-Serve Bulk CLI Pack — £19 (Instant PayPal Download)
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
⚡ 100% Asynchronous Delivery (Zero Meetings Required): All Fiverr gigs and compliance packs are delivered as self-contained, board-ready HTML executive reports + copy-paste DNS/server configs via Fiverr or [email protected]—no sales calls or calendar bloat.
100% FREE FOREVER · NO POPUPS · NO SIGNUPS

Saved you an afternoon of headaches? Buy me a coffee. ☕

I built these scanners and Chrome extensions so you can get instant answers without booking a sales call or handing over your email—if they just saved your day, a coffee keeps the late-night builds going.

☕ Buy Adam a £5.00 Coffee via PayPal →
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
\n
LIVE 30-MINUTE SCRAPED SECURITY & CVE RADAR · SYNCED 2026-10-28 20:32 UTC

Breaking NCSC, CISA, THN, WordPress & PHP Advisories Mapped to Instant UK Domain Fixes

Pre-rendered every 30 minutes from 6 official security feeds (UK NCSC, CISA KEV, The Hacker News, WordPress.org Security, BleepingComputer, PHP.net) for instant search-engine & AI answer-engine indexing. Open the full 12-Advisory UK Threat & CVE Radar → or subscribe via RSS 2.0 Threat Feed (`feed.xml`).

GitHub Security Advisories · CVE-2026-108360 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108360: [phpoffice/phpspreadsheet] PhpSpreadsheet:… ↗

## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetch

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-108082 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-108082: [symfony/http-foundation] Symfony: ReDoS in… ↗

### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\s)` lookbehind. A run of whitespace placed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-109413 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-109413: [symfony/symfony] Symfony: Unbounded Recursion… ↗

### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nestin

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗
GitHub Security Advisories · CVE-2026-116675 £12 WordPress & WooCommerce Security Shield Pack

CVE-2026-116675: [tinymce] TinyMCE Cross-Site Scripting (XSS)… ↗

### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed bef

UK Domain Fix (£12): Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.

Run Free Scanner → Full Threat Radar → Source Advisory ↗