FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
Inbound Mail Gateway & Transport Security · Credit: Adam Tucker / FaultyPacket Observatory

MX Record, Mail Gateway & Inbound Transport (`_mta-sts` / `_smtp._tls` / `DNSSEC` / `CAA`) Engineering Guide

Across 3,678,611+ domains audited by Adam Tucker and the FaultyPacket Internet Mail Security Observatory, fewer than 2.1% publish RFC 8461 MTA-STS (_mta-sts) to prevent SMTP STARTTLS downgrade attacks on their MX records.

1. What Your MX Record & Inbound Transport Vectors Reveal

When our browser-local 20-Lookup SuperTool inspects your domain via Cloudflare 1.1.1.1 DoH, it evaluates your MX priority table alongside four critical transport controls:

VectorHealthy Sovereign TargetNeutral Observation When Absent / Unreachable
MX GatewaysRedundant priority-ordered MX hostsNo MX published (or null MX 0 . for parked domains)
_mta-sts & Policyv=STSv1 + HTTPS mode: enforceNo _mta-sts TXT record published (or policy fetch marked UNASSESSED on timeout)
DNSSECSigned DS / RRSIG chain validatedDNSSEC not published / validated
CAAExplicit 0 issue "letsencrypt.org" lockNo CAA restriction published

2. Deploying MTA-STS & SMTP TLS-RPT in 60 Seconds

Our £5 Starter Quick-Fix Pack and £24 DMARC, SPF & MTA-STS Remediation Pack generate the exact /.well-known/mta-sts.txt file matched to your live MX hostnames plus your first-party _smtp._tls reporting record.

Run Your Free 20-Lookup Browser Scan or Grab a £5–£39 Copy-Paste Fix Pack

Test your domain in 60 seconds with zero server-side PII retention using the FaultyPacket 20-Lookup SuperTool, or download our instant offline remediation packs (with Verified Before/After DNS Certificate & Boss/DPO KPI Victory Memo).

Launch Free 20-Lookup SuperTool → View £5 Starter / £12 WP / £19 NIS2 / £24 DMARC / £29 CE v3.3 / £39 Bundle → 24h Async Fiverr Fulfilment →

Frequently Asked Questions

Why does MTA-STS matter if my mail server already supports STARTTLS?

Without MTA-STS (RFC 8461) in enforce mode, an active network attacker can strip the STARTTLS advertisement during SMTP negotiation and force inbound mail to fall back to cleartext.

How does FaultyPacket handle DNS or HTTPS timeouts during a scan?

Any DNS, policy, or HTTP probe that times out or returns SERVFAIL is strictly labeled UNASSESSED and excluded from scoring denominators rather than penalised as a missing record.