UK Cyber Security and Resilience Bill reaches Lords third reading: what the UK part of the sample shows
Published 31 October 2026. Sources last checked 31 October 2026. Figures: October 2026 snapshot, as of 31 October 2026.
The regulatory step
The Cyber Security and Resilience (Network and Information Systems) Bill is before Parliament.
- UK Parliament Bills service, Bill 4035: https://bills.parliament.uk/bills/4035, checked 31 October 2026.
What the sample shows
For the UK groups of the fixed 338-domain sample, public DNS on the snapshot date showed:
| Group | n | p=reject | No valid record | External report address |
|---|---|---|---|---|
| Managed IT, hosting and security suppliers Region: UKSector: IT suppliers | 48 | 37.5% | 6.2% | 68.8% |
| Housing, utilities, transport and infrastructure Region: UKSector: Infrastructure | 34 | 67.6% | 0.0% | 88.2% |
Across the 336 answered domains of the 338, 61.9% published p=reject and 77.1% asked for reports to go to an external address.
Reading this note
This note places dated public-DNS figures next to a current regulatory step. It makes no claim about whether any law applies to any organisation in the sample, or how. Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation.
Sample, date and method
Sample. A fixed, pre-declared list of 338 organisation domains (249 UK, 86 EU, 3 without a sector label), defined by the domain list of the FaultyPacket 338-domain DMARC study file published on 28 October 2026. The list is frozen: no domain is added, removed or swapped, and the run stops if the list changes. Sector and region tags come from the label each domain carries in the FaultyPacket 1,611-domain study file of 29 October 2026; the 3 domains without a label count in the overall figures and in no sector.
Date. Queries ran from 2026-10-31T08:03:47Z to 2026-10-31T08:10:41Z (UTC). 336 of 338 domains returned an answer.
Method. For every domain in the fixed list, the TXT record at _dmarc.<domain> was requested from two public DNS-over-HTTPS resolvers (1.1.1.1 via cloudflare-dns.com and 8.8.8.8 via dns.google) at no more than two queries per second. Where both answered with different text, the query was repeated once; where both answered, the 1.1.1.1 answer is the one counted. Policy is the p= tag of a single valid v=DMARC1 record; no record, more than one record, or an unrecognised p= value counts as no valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=. External means a host outside the domain and its subdomains. Collector headquarters come from the FaultyPacket provider list (version T0-T5-v2.2-2026-10-28+sha9d5155ea38); a host not on the list, or a company listed with more than one headquarters region, counts as headquarters not classified. No other records, web pages, contact details or personal data were collected.
Disclaimer. Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation.
Data file: aggregate JSON · CSV · open API. Licence: CC BY 4.0. No domain names are published in these files.
All observatory notes · Press and data kit
Domain-level detail, corrections and right of reply
Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.
We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.
Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.