FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,242,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

DNSSEC SERVFAIL After Changing DNS Provider: How to Fix It

The short answer (what's causing it)

If the registrar still holds a DS record for the old provider's key, validating resolvers can't verify the new zone and return SERVFAIL — the domain appears offline for some users and mail can bounce.

Step-by-step fix

  1. Confirm with a validating resolver (e.g. dig @1.1.1.1 yourdomain) and a non-validating check (+cd).
  2. Remove the old DS at the registrar, or
  3. Enable DNSSEC at the new provider and publish its DS.
  4. Wait for TTLs, then re-scan.

Record examples (replace example.co.uk with your domain)

dig @1.1.1.1 example.co.uk A        # SERVFAIL
dig @1.1.1.1 example.co.uk A +cd    # answers -> DNSSEC chain broken
example.co.uk. DS 12345 13 2 <digest-from-new-provider>

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: DNSSEC, SOA.

Scan my domain free (20-check SuperTool) →

No FaultyPacket pack covers this specific topic, so we only recommend the free scan here.

Frequently Asked Questions

Should I just turn DNSSEC off?

Removing the DS restores service; re-enable properly afterwards.

How do I avoid this next time?

Disable DNSSEC (remove DS) and wait out TTLs before migrating, or do a multi-signer migration.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.