Using MxToolBox or DMARCly in the UK & EU? External DMARC Reporting Destination Observed (T0–T5) & GDPR Art. 28 / NIS2 Governance Review (2026 Comparison)
Original 2026 Research by Adam Tucker (FaultyPacket Security): We Discovered & Benchmarked This Widespread GDPR Art. 44 & NIS2 Art. 21 _dmarc US-SaaS Leak Across 338 UK & EU Companies—And Engineered the Sovereign Replacement. When we audited 338 major UK & European domains via Cloudflare 1.1.1.1, we discovered 76.6% (259 domains) route daily DMARC telemetry to third-party SaaS processors, 48.2% (163 domains) stream it to US-headquartered clouds subject to the US CLOUD Act, and 36 household brands pay monthly while still sitting on p=none. Because US SaaS vendors cannot “quick-patch” their corporate jurisdiction or remotely edit your DNS zone, we built a 100% browser-local auditor and one-time £5–£39 GBP self-hosted remediation engine to fix it permanently.
Live DMARC RUA/RUF Data Residency & US SaaS Routing Auditor
Enter any UK or EU domain below to check its public _dmarc TXT record in real time. We inspect every rua=mailto: and ruf=mailto: destination directly in your browser to flag whether your domain is leaking aggregate XML or forensic failure reports to third-party US SaaS collectors (MxToolBox, DMARCly, Proofpoint, Agari, Valimail, dmarcian) or keeping telemetry 100% self-hosted:
Look Like a Legend in Your Next KPI / Board Review (“Hey Boss, I Fixed This Today”) BOSS & DPO READY
IT managers and sysadmins rarely get credit until something breaks. Every £5, £12, £19, £24, £29, and £39 FaultyPacket pack (plus our free 1-page Executive PDF Summary and BOSS_AND_DPO_KPI_VICTORY_MEMO.md) includes a Boss-Ready KPI & DPO Sign-Off Certificate / Before-and-After Brag Sheet you can hand straight to your Managing Director, DPO, or Board proving three measurable wins:
1. 🛡️ Compliance WinGDPR & NIS2
“Eliminated external third-party DMARC processor overhead under GDPR Art. 28 / Chapter V & NIS2 Art. 21 by routing rua= to a Tier T0 first-party mailbox and stripping forensic ruf= tags.”
2. 🔒 Security Win100% Spoof Block
“Upgraded domain from p=none (0% spoofing protection) to p=reject (100% executive & invoice spoofing block) + Cyber Essentials v3.3 alignment.”
3. 💰 Budget Win£480–£960/yr Saved
“Eliminated £480–£960/year ($49–$99/mo) in recurring US DMARC SaaS subscriptions with a permanent, sovereign self-hosted configuration.”
Calculate Your Exact 1-Year & 3-Year DMARC SaaS Savings (And Verify Your p=none → p=reject Upgrade)
£0/mo Sovereign Target
Enter your current (or quoted) monthly third-party DMARC/DNS SaaS spend below. Your exact 1-Year and 3-Year net savings automatically populate into the 1-Click “Hey Boss / DPO” KPI Victory Email above.
p=Reject Challenge? Save your domain's pre-fix baseline before editing DNS, then verify and print your timestamped Before → After Delta Certificate:
FaultyPacket (UK/EU Sovereign) vs MxToolBox vs DMARCly vs IntoDNS.ai / Enterno.io
When a European DPO, ISO 27001 lead auditor, or NIS2 supply-chain assessor inspects your DNS zone file, your _dmarc record is public evidence. Compare how FaultyPacket stacks up against legacy US SaaS platforms and diagnostic-only clones:
| Evaluation Criteria | 🇬🇧🇪🇺 FaultyPacket (UK/EU Sovereign) | 🇺🇸 MxToolBox (US SaaS) | 🇺🇸 DMARCly (US SaaS) | 🌐 IntoDNS.ai / Enterno.io |
|---|---|---|---|---|
| Data Residency & RUA/RUF Routing | 100% Self-Hosted RUA/RUF 100% Self-Hosted RUA/RUF on your own domain, Zero US PII transfer. Live queries execute client-side in your browser via 1.1.1.1 DoH. |
US Multi-Tenant SaaS Requires pointing rua= / ruf= to US-hosted MxToolBox ingestion servers (Texas, USA), streaming daily mail telemetry outside UK/EEA. |
US Cloud Ingestion Routes aggregate & forensic failure XML reports to US-managed SaaS endpoints; requires cross-border processor agreements. |
Server-Side Proxy Logs Centralised server-side DNS lookup proxy; no self-hosted RUA/RUF parser or sovereign offline CLI toolkit. |
| GDPR & NIS2 Article 21 Compliance | Native UK/EU GDPR & NIS2 Ready Zero third-party sub-processor DPA or Chapter V Transfer Risk Assessment (TRA/TIA) needed. Built-in NIS2 Art. 21(2)(d) & DORA Art. 28 supplier register export. |
GDPR Ch. V & RUF PII Risk Forensic ruf= reports expose sender/recipient PII & headers to US jurisdiction; triggers SCC/TRA overhead and NIS2 supply-chain scrutiny. |
Requires SCCs & RUF Redaction US SaaS sub-processor footprint requires GDPR Art. 28 DPA, Transfer Impact Assessments, and manual RUF PII stripping. |
No NIS2 / GDPR Evidence Single-domain web lookup only. No NIS2 Article 21 supplier register, no DORA ICT inventory, and no UK Cyber Essentials v3.3 mapping. |
| Pricing & Commercial Model | £5–£39 One-Off GBP Checkout £5–£39 One-Off GBP Checkout — No USD Recurring SaaS. 20-tool Browser SuperTool & Chrome MV3 extensions are 100% Free Forever. |
$129–$399/mo USD ($1,548+/yr) Expensive recurring USD subscription with strict domain/volume tier caps and FX conversion fees for UK/EU finance teams. |
$17–$199/mo USD ($204–$2,388/yr) Perpetual monthly/annual USD billing; stops processing your DMARC reports the day you cancel the subscription. |
Ad-Supported / Upsell Funnel Free basic DNS readout, but zero downloadable compliance packs or fixed-price engineering fulfilment. |
| Drop-In Fix Packs & Remediation | Included (Copy-Paste Fixes) Included: RFC 7208 flattened SPF zone files ( ≤3 lookups), staged DMARC p=reject records, mta-sts.txt, Nginx/Apache/Cloudflare WAF rules & offline Python CLI. |
Diagnosis Only Diagnosis Only: Flags errors in a dashboard but leaves your sysadmin to manually write SPF flattening macros, MTA-STS policies, and web server headers. |
Diagnosis & Wizard Only Diagnosis Only: Generates hosted CNAME/TXT records tied to their SaaS platform rather than sovereign, vendor-independent zone files. |
Diagnosis Only Diagnosis Only: Displays raw SOA/NS/MX/TXT status indicators with zero drop-in server or DNS remediation configs. |
| Keyless JSON API & Automation | Free Keyless API (/api/open/scan) Instant keyless GET endpoint ( /api/open/scan?domain=example.co.uk) returning live SPF, DMARC, MX, MTA-STS, CAA & grade JSON for CI/CD and cron monitoring. |
API Key & Paid Tier Required REST API locked behind account registration, API keys, and paid USD monthly plans once free lookup quotas expire. |
Closed SaaS Dashboard No public keyless diagnostic API for instant unauthenticated CI/CD or terminal curl checks. |
Web UI Only Designed for manual browser page loads; no documented open JSON SecOps API or offline bulk Python CLI. |
3 Reasons UK & EU Organisations Are Dropping US DMARC SaaS Collectors in 2026
1. Forensic RUF Reports Contain Unredacted PIIUK/EU GDPR Art. 5 & 44
When an admin copies a default MxToolBox or DMARCly snippet containing ruf=mailto:... into DNS, participating mail receivers generate RFC 6591 / RFC 7489 Failure Reports whenever an email fails authentication. Those forensic payloads routinely include sender and recipient email addresses, full MIME headers, subject lines, IP addresses, and message body previews—streaming personal data straight to US multi-tenant storage without user consent or data minimisation.
2. NIS2 Article 21(2)(d) Supply-Chain SovereigntyEU NIS2 & DORA Art. 28
Under EU NIS2 Article 21(2)(d) and DORA Article 28, Essential and Important Entities must audit the cybersecurity posture and third-party data exposure of their ICT supply chain. Routing every domain’s daily RUA XML inventory (which maps every SaaS CRM, ERP, payroll sender, and IP range your company uses) to an external US SaaS vendor creates an unnecessary critical ICT sub-processor dependency.
3. Hosted CNAME/SPF Lock-In Breaks Zone Autonomy100% Sovereign DNS
US DMARC SaaS platforms push “dynamic SPF flattening” hosted on their own CNAME/include servers for $1,500+/yr. The moment you cancel your USD subscription—or their US authoritative cluster suffers a latency spike—your SPF record returns PermError and Gmail/M365 drops your invoices with 550-5.7.26. FaultyPacket gives you permanent, self-hosted zone files you own forever for £5–£24 one-off.
The Sovereign UK/EU Blueprint: Self-Hosted _dmarc + Browser-Local DoHZERO US TRANSFER
Replace third-party US SaaS URIs with a self-hosted mailbox on your own domain and parse XML reports locally using the offline Python 3 evaluator included in our £24 DMARC Pack (or £39 Master Bundle):
; ❌ BEFORE (US SaaS Telemetry Leakage + Unredacted RUF PII Risk) _dmarc.yourdomain.co.uk. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; fo=1" ; ✅ AFTER (100% UK/EU Sovereign Self-Hosted DMARC + Strict Alignment) _dmarc.yourdomain.co.uk. 3600 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; pct=100; rua=mailto:[email protected]!10m; fo=0" ; ✅ ZERO-INSTALL KEYLESS API CHECK (Run from any UK/EU terminal or cron job) curl -s "https://faultypacket.co.uk/api/open/scan?domain=yourdomain.co.uk" | jq .
Why US DMARC SaaS Vendors Cannot “Quick-Patch” This GDPR & NIS2 Exposure
When UK and European CISOs or Data Protection Officers realise their public _dmarc record is streaming daily email telemetry to a US cloud, the first question they ask their vendor is: “Can you just patch this on your backend?” Here are the four technical and statutory reasons why third-party US DMARC SaaS vendors cannot hotfix this away:
Even if a US-incorporated vendor (MxToolBox, Valimail, dmarcian, Proofpoint, EasyDMARC Inc., SendGrid) spins up an AWS Frankfurt or Dublin bucket, the US CLOUD Act and FISA § 702 compel any US legal entity to surrender data in its possession, custody, or control globally without an EU/UK judicial warrant—the core conflict under GDPR Art. 44 / Schrems II.
DMARC routing is hardcoded inside your own authoritative DNS zone (rua=mailto:[email protected], rep.dmarcanalyzer.com, emaildefense.proofpoint.com). No SaaS vendor has write access to your Cloudflare, Route 53, or Azure DNS. Because your IT team has to manually edit the _dmarc TXT record anyway, switching to a sovereign mailto:dmarc-reports@<your-domain> takes the exact same 60-second DNS edit and eliminates recurring SaaS fees forever.
Unlike web analytics where a vendor can insert an edge proxy, DMARC rua= and forensic ruf= failure reports are emailed directly by Google, Microsoft, and Yahoo MTAs to whatever address sits in your public _dmarc record. Unredacted sender IPs, employee From:/To: headers, and subject lines arrive at the third-party processor before any client-side scrubbing can occur.
p=none
Across 338 major UK & EU domains we audited via Cloudflare 1.1.1.1, 259 (76.6%) route DMARC reports to third-party SaaS processors, 163 (48.2%) stream to US clouds, and 36 household names are paying external DMARC tools while still sitting on p=none (0% spoofing protection).
Live 2026 UK & EU Public _dmarc US-Telemetry & Third-Party Processor Audit Index
Because _dmarc.<domain> TXT records are public DNS, anyone can verify where an organisation routes its daily DMARC Aggregate (rua=) and Forensic (ruf=) XML telemetry. Across 338 major UK & European domains audited via Cloudflare 1.1.1.1 DNS-over-HTTPS, 259 domains route DMARC telemetry to external third-party SaaS processors (including 163 streaming telemetry to US-headquartered clouds and 36 paying a third-party vendor while still sitting on p=none):
| UK / EU Domain | Live Policy | Detected Public rua= / ruf= Processor |
GDPR Art. 44 & NIS2 Art. 21 Finding | Instant Browser Check |
|---|---|---|---|---|
| ans.co.uk | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit ans.co.uk → |
| burberry.com | p=none | Red Sift OnDMARC (External SaaS), DMARCly (US Cloud Telemetry)inbox.ondmarc.com, ag.dmarcly.com, fo.dmarcly.com |
US Cloud Telemetry + p=none Spoofable | Audit burberry.com → |
| carrefour.fr | p=none | Mimecast / DMARC Analyzer (External SaaS), Third-Party Processor (carrefour.com), Third-Party Processor (rep.de.mimecastdmarcanalyzer.com), Third-Party Processor (for.de.mimecastdmarcanalyzer.com)rep.dmarcanalyzer.com, carrefour.com, rep.de.mimecastdmarcanalyzer.com, for.dmarcanalyzer.com, for.de.mimecastdmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit carrefour.fr → |
| cinch.co.uk | p=none | URIports (External SaaS)q9kjk0mu.uriports.com |
US Cloud Telemetry + p=none Spoofable | Audit cinch.co.uk → |
| footanstey.com | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit footanstey.com → |
| glanbia.com | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit glanbia.com → |
| jdsports.co.uk | p=none | Third-Party Processor (dmarc.mailgun.org), Red Sift OnDMARC (External SaaS), Third-Party Processor (jdplc.com)dmarc.mailgun.org, inbox.ondmarc.com, jdplc.com |
US Cloud Telemetry + p=none Spoofable | Audit jdsports.co.uk → |
| littlefish.co.uk | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit littlefish.co.uk → |
| node4.co.uk | p=none | Red Sift OnDMARC (External SaaS)inbox.ondmarc.com |
US Cloud Telemetry + p=none Spoofable | Audit node4.co.uk → |
| premierinn.com | p=none | Proofpoint (US Cloud Telemetry)emaildefense.proofpoint.com |
US Cloud Telemetry + p=none Spoofable | Audit premierinn.com → |
| pret.co.uk | p=none | DMARCly (US Cloud Telemetry)ag.dmarcly.com, fo.dmarcly.com |
US Cloud Telemetry + p=none Spoofable | Audit pret.co.uk → |
| savills.co.uk | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit savills.co.uk → |
| tui.co.uk | p=none | Red Sift OnDMARC (External SaaS)inbox.ondmarc.com |
US Cloud Telemetry + p=none Spoofable | Audit tui.co.uk → |
| ukfast.co.uk | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit ukfast.co.uk → |
| unitedutilities.com | p=none | Proofpoint (US Cloud Telemetry)emaildefense.proofpoint.com |
US Cloud Telemetry + p=none Spoofable | Audit unitedutilities.com → |
| visma.com | p=none | Postmark ActiveCampaign (US Cloud Telemetry)dmarc.postmarkapp.com |
US Cloud Telemetry + p=none Spoofable | Audit visma.com → |
| freshfields.com | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit freshfields.com → |
| lawsociety.org.uk | p=none | Mimecast / DMARC Analyzer (External SaaS)rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
US Cloud Telemetry + p=none Spoofable | Audit lawsociety.org.uk → |
| 20i.com | p=quarantine | Third-Party Processor (ag.eu.dmarcadvisor.com), Mimecast / DMARC Analyzer (External SaaS)ag.eu.dmarcadvisor.com, rep.dmarcanalyzer.com, for.dmarcanalyzer.com |
GDPR Art. 44 US RUA/RUF Transfer | Audit 20i.com → |
| alan.com | p=quarantine | Third-Party Processor (alan.eu), URIports (External SaaS)alan.eu, alanhealth.uriports.com |
GDPR Art. 44 US RUA/RUF Transfer | Audit alan.com → |
UK & European MxToolBox / DMARCly Alternative FAQ
Best UK & EU Sovereign MxToolBox Alternative?UK/EU Sovereign
FaultyPacket (faultypacket.co.uk) is an independent UK/EU-sovereign alternative to MxToolBox and DMARCly. Its 20-tool Browser SuperTool runs live DNS-over-HTTPS (DoH) queries locally in your browser with zero server-side PII retention, provides a free keyless JSON API (/api/open/scan), and ships self-hosted RUA/RUF DMARC templates for a one-off £5–£39 GBP checkout instead of a recurring USD SaaS subscription.
Why US RUA/RUF SaaS Fails GDPR & NIS2 Art. 21Chapter V Risk
DMARC Forensic (RUF) reports can contain unredacted email headers, sender/recipient addresses, and subject lines, while Aggregate (RUA) XML reports expose your complete sending IP and shadow-IT vendor inventory. Pointing rua= or ruf= to a US SaaS processor streams this data across borders daily, triggering UK/EU GDPR Chapter V transfer assessments (TRA/TIA) and NIS2 Article 21(2)(d) supply-chain scrutiny.
Enforce DMARC p=reject Without USD SaaSOne-Off £5–£24
Keep rua=mailto:[email protected] pointed at a mailbox on your own UK/EU M365 or Google Workspace tenant, omit cross-border ruf= streaming, and use our £24 DMARC, SPF & MTA-STS Remediation Pack (or $25 24-hour Fiverr Done-For-You service) to flatten SPF below 10 lookups and transition safely to p=reject.
How does FaultyPacket compare to IntoDNS.ai and Enterno.io?Fix Packs Included
Diagnostic-only clones like IntoDNS.ai and Enterno.io only display raw DNS status lights without giving you the engineering cure. FaultyPacket combines 20 free browser-local lookups and a keyless JSON API (/api/open/scan) with drop-in production DNS zone files, Nginx/Apache/IIS/Cloudflare WAF configs, and auditor-ready UK Cyber Essentials v3.3 and EU NIS2 Article 21 CSV registers.
📘 FaultyPacket Internet Mail Security Observatory — Methodology, Scope & Correction Policy (v2.2 · Oct 2026)Reproducible Public DNS Evidence
Empirical Observation vs. Legal Assessment: All statistics published by the FaultyPacket Internet Mail Security Observatory (including our 338-Domain Regulated Benchmark and our rolling 10-Million-Domain Census, currently at 3,678,611+ domains audited) are derived from live, reproducible public DNS queries (_dmarc, SPF, MX, _mta-sts, _smtp._tls, CAA, and DNSSEC) via Cloudflare 1.1.1.1 and multi-resolver verification. Lookups that return network timeouts or SERVFAIL are classified as UNASSESSED and excluded from percentage denominators. Routing DMARC reports to a third-party or US-headquartered vendor is a technical observation from public DNS (rua= / ruf=), not an automatic legal determination under GDPR Article 44 or NIS2 Article 21; organisations should review their own transfer mechanisms (such as DPF/SCCs and processor DPAs) or route reports directly to an internal UK/EU mailbox to eliminate third-party processor overhead altogether.
Live Re-Verification & Corrections: Any domain owner who updates their DNS records can verify their live posture immediately using the FaultyPacket 20-Lookup SuperTool or request a dataset refresh at [email protected]. Raw datasets: 10M Observatory Hub · 338-Domain Study JSON · 10M Observatory Live JSON.