FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,162,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

MTA-STS: How to Move From Testing to Enforce

The short answer (what's causing it)

In mode: testing, senders report TLS failures but still deliver. In enforce, they refuse delivery if TLS to a listed MX can't be validated. Switching blindly can bounce mail if an MX or certificate is wrong.

Step-by-step fix

  1. Confirm TLS-RPT is set up and reports show no failures.
  2. Check every MX hostname is listed in mx: lines and has a valid public certificate.
  3. Change mode: testing to mode: enforce and raise max_age (e.g. 604800+).
  4. Update the id= in the _mta-sts TXT so senders refetch.
  5. Scan free to confirm.

Record examples (replace example.co.uk with your domain)

_mta-sts.example.co.uk. TXT "v=STSv1; id=20261029T01"
# https://mta-sts.example.co.uk/.well-known/mta-sts.txt
version: STSv1
mode: enforce
mx: example-co-uk.mail.protection.outlook.com
max_age: 604800

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: MTA-STS, TLS-RPT, MX.

Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

What if I forget to change the id?

Senders keep the cached testing policy until max_age expires.

Can I roll back?

Yes — set mode: none with a new id; cached enforce policies persist until expiry, so be cautious.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.