We Audited 338 Major UK & EU Domains via 1.1.1.1: 76.6% Route _dmarc Telemetry to 3rd-Party SaaS, 48.2% Stream to US Clouds, and 36 Household Brands Pay Monthly for p=none

Q1 · Sovereign & Enforced (Target State)26.47% (483,882)

Criteria: p=reject or p=quarantine + T0 Self-Hosted First-Party Mailbox (or T1 Gov collector). Active spoofing block with zero external processor DPA or Chapter V transfer overhead.

Q2 · Enforced with External Processor14.48% (264,592)

Criteria: p=reject or p=quarantine + T2–T5 External RUA collector. Spoofing is blocked, but the DPO must maintain GDPR Art. 28 DPAs, Chapter V transfer safeguards, and NIS2 Art. 21 supplier records.

Q3 · Internal Monitoring Only45.25% (827,126)

Criteria: p=none + T0 Self-Hosted or no external RUA. Zero third-party processor exposure, but spoofing remains unblocked until upgraded to p=reject.

Q4 · Monitoring Without Enforcement13.80% (252,291)

Criteria: p=none + T2–T5 External Third-Party RUA Processor. The domain streams daily telemetry to an outside service while still sitting in monitor-only mode (0% spoofing block).

1. "DMARC aggregate reports (rua=) are just XML IP counts, not personal data!"

We strictly separate aggregate rua= XML from forensic ruf= failure reports (which 28.1% of DMARC domains still enable and which can carry headers/subjects). Even for rua=, IP addresses and sender topologies routed to an external vendor require a GDPR Art. 28 processor review—which a self-hosted T0 mailbox avoids completely.

2. "Our US SaaS vendor is certified under the EU-US Data Privacy Framework (DPF) / SCCs!"

Our methodology explicitly notes that DPF or SCCs may provide a lawful transfer mechanism. However, maintaining DPAs, sub-processor monitors, and Transfer Impact Assessments (TIAs) for a basic DNS record is unnecessary governance overhead when routing rua= to your own mailbox costs £0/mo.

3. "Domains on p=none might have just onboarded last week!"

True—a single DNS snapshot shows current state, not onboarding date. That is why we launched our hourly longitudinal state database (tracking 3,678,611+ domains) so we can measure how many p=none domains graduate to p=reject over 30, 60, and 90 days versus remaining in long-term drift.

4. "Raw XML reports are unreadable without a $99/mo SaaS dashboard!"

For a 50-domain global airline, a SaaS parser can be useful. For the 95% of SMEs with 1–3 domains using Microsoft 365/Google Workspace plus Shopify, Xero, or HubSpot, our offline parser and 20-in-1 browser scanner identify every authorised sender in 60 seconds with zero monthly subscription.

5. "We use an .eu ingestion hostname (e.g. ag.eu.*), so it's 100% EU sovereign!"

An .eu hostname indicates regional ingestion infrastructure, which is better than US ingestion—but DPOs must still verify the parent legal entity, support access locations, and sub-processor chain. Our T0–T5 taxonomy surfaces both the hostname and corporate HQ so DPOs have full clarity.

6. "Microsoft 365 or Google Workspace already hosts our email in the cloud anyway!"

Your primary mail tenant is already covered by your core enterprise DPA and UK/EU data-residency boundary. Adding a separate third-party DMARC SaaS vendor introduces an additional external processor and NIS2 supply-chain dependency that you don't need if reports stay inside your existing mail tenant.

7. "Switching to p=reject will break our legitimate marketing or invoice emails!"

Jumping blindly to p=reject without aligning SPF and DKIM breaks mail. That is why our £5–£39 packs include pre-flight SPF lookup flattening (<10 lookups), DKIM selector verification for M365/Google/Shopify/Xero, and a staged pct=25 → 100 rollout script.

8. "Doesn't NCSC Cyber Essentials v3.3 already cover our security?"

Cyber Essentials doesn't tell you whether your domain can be spoofed. CE v3.3 assesses five core network/endpoint controls, not DMARC p=reject or _mta-sts. Our Cyber Essentials v3.3 Prep + Email/Domain Security Gap Pack (£29) closes both the 5 CE controls and the domain spoofing gap insurers check.