FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,162,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

How to Read a DMARC Aggregate Report (XML)

The short answer (what's causing it)

Aggregate reports are zipped XML files summarising, per source IP, how many messages claimed your domain and whether SPF/DKIM passed and aligned. They look intimidating but have a small number of fields that matter.

Step-by-step fix

  1. Unzip and open the XML.
  2. For each <record>: note source_ip, count, policy_evaluated (disposition, dkim, spf).
  3. Map unknown IPs to services (reverse DNS / ASN).
  4. Fix legitimate failing sources; ignore or block spoofers.
  5. Repeat until clean, then tighten policy.

Record examples (replace example.co.uk with your domain)

<record><row><source_ip>203.0.113.10</source_ip><count>42</count>
<policy_evaluated><disposition>none</disposition><dkim>fail</dkim><spf>pass</spf></policy_evaluated></row>
<identifiers><header_from>example.co.uk</header_from></identifiers></record>

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: DMARC.

Scan my domain free (20-check SuperTool) → £24 Sovereign DMARC (T0 RUA), SPF, MTA-STS & PHP2Shell Remediation Pack → £5 Website Launch Special Quick-Fix Pack →

One-off download via PayPal guest checkout, no subscription. Packs contain DNS/config templates and scripts you run yourself.

Frequently Asked Questions

Do I need a SaaS dashboard?

No — small domains can read XML directly or with a local script.

What's the difference with ruf?

ruf are per-message forensic reports; few receivers send them and they may contain personal data.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.