Research: press and data kit for the 338-domain DMARC sample

AGGREGATE DATA · NO DOMAIN NAMES · CC BY 4.0

October 2026 snapshot, as of 31 October 2026. Next refresh due on or after 28 November 2026.

Aggregate figures on DMARC policy and report routing for a fixed sample of 338 UK and EU organisation domains, re-checked every month. Download the data, check a record yourself, or reuse the neutral sentences and charts below with credit.

Journalist one-pager One-pager PDF Sector aggregates

Downloads

Aggregate data (JSON): overall and sector counts and percentages, sample definition, date, method, resolvers and snapshot history.
Aggregate data (CSV): one row per scope, measure and category.
Charts (SVG): DMARC policy · report routing · policy by sector group.
Open API: GET /api/open/observatory returns the same aggregates as JSON, no key needed, CORS enabled. Add ?sector=uk-finance (or another sector slug) for one group. It does not look up individual domains.

The files hold aggregate counts. They contain no domain names, no contact details and no personal data.

Headline figures

61.9%

published p=reject (208 of 336 answered)

77.1%

asked for DMARC reports to go to an external address (259 of 336 answered)

32.4%

listed a report address at a US-headquartered organisation on the provider list (109 of 336 answered)

10.7%

listed an external report address while on p=none (36 of 336 answered)

Check your own domain free in seconds →

Neutral sentences you can lift

Each sentence states what public DNS showed on the snapshot date. Please keep the date and the credit line.

In a fixed sample of 338 UK and EU organisation domains checked on 31 October 2026, 336 returned a DNS answer. Of those, 208 (61.9%) published a DMARC policy of p=reject.Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.

259 of the 336 domains that answered (77.1%) asked for DMARC reports to be sent to an address outside their own domain.Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.

109 of the 336 domains that answered (32.4%) asked for reports to go to an address at one of the US-headquartered organisations on the provider list.Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.

36 of the 336 domains that answered (10.7%) asked for reports to go to an external address while their policy was p=none, which asks receiving servers to deliver failing mail as normal.Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.

12 of the 336 domains that answered (3.6%) had no valid DMARC record on that date.Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.

Sector aggregates

Sector groups with at least 10 domains in the sample, each tagged by region and sector:

Listed companies and retail Region: UKSector: Listed and retail (n=90)
Accountancy, fintech, insurance and wealth Region: UKSector: Finance (n=49)
Managed IT, hosting and security suppliers Region: UKSector: IT suppliers (n=48)
Housing, utilities, transport and infrastructure Region: UKSector: Infrastructure (n=34)
Law firms Region: UKSector: Legal (n=28)
Germany (mixed sectors) Region: EUSector: Germany (n=29)
Nordics, Ireland and eastern Europe (mixed sectors) Region: EUSector: Nordics, Ireland, east (n=24)
France (mixed sectors) Region: EUSector: France (n=19)
Benelux, Switzerland, Austria, Italy and Spain (mixed sectors) Region: EUSector: Benelux, Alpine, south (n=14)

What changed since last month

The October 2026 snapshot is the baseline for the monthly refresh. The next refresh of the same 338 domains is due on or after 28 November 2026; changes will then be shown here as counts, with no domain named.

Observatory notes

Short, dated notes that place these numbers next to a current regulatory step, with official sources.

All observatory notes

Check a record yourself in 60 seconds

Every figure here comes from one public DNS record per domain. Anyone can read the same record. Replace example.com with a domain you want to look at.

On macOS or Linux, open a terminal and ask two public resolvers:dig +short TXT _dmarc.example.com @1.1.1.1 dig +short TXT _dmarc.example.com @8.8.8.8
On Windows, use:nslookup -type=TXT _dmarc.example.com 1.1.1.1
In a browser, open https://dns.google/resolve?name=_dmarc.example.com&type=TXT and look at the data field.
Read the answer: p= is the policy (reject, quarantine or none). Addresses after rua= and ruf= are where reports go. If the part after the @ is not the domain itself (or one of its subdomains), the address is external.

DNS answers can change at any time, and a record you read today may differ from the snapshot date shown on this page.

Sample, date and method

Sample. A fixed, pre-declared list of 338 organisation domains (249 UK, 86 EU, 3 without a sector label), defined by the domain list of the FaultyPacket 338-domain DMARC study file published on 28 October 2026. The list is frozen: no domain is added, removed or swapped, and the run stops if the list changes. Sector and region tags come from the label each domain carries in the FaultyPacket 1,611-domain study file of 29 October 2026; the 3 domains without a label count in the overall figures and in no sector.

Date. Queries ran from 2026-10-31T08:03:47Z to 2026-10-31T08:10:41Z (UTC). 336 of 338 domains returned an answer.

Method. For every domain in the fixed list, the TXT record at _dmarc.<domain> was requested from two public DNS-over-HTTPS resolvers (1.1.1.1 via cloudflare-dns.com and 8.8.8.8 via dns.google) at no more than two queries per second. Where both answered with different text, the query was repeated once; where both answered, the 1.1.1.1 answer is the one counted. Policy is the p= tag of a single valid v=DMARC1 record; no record, more than one record, or an unrecognised p= value counts as no valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=. External means a host outside the domain and its subdomains. Collector headquarters come from the FaultyPacket provider list (version T0-T5-v2.2-2026-10-28+sha9d5155ea38); a host not on the list, or a company listed with more than one headquarters region, counts as headquarters not classified. No other records, web pages, contact details or personal data were collected.

Disclaimer. Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation.

Data file: aggregate JSON · CSV · open API. Licence: CC BY 4.0. No domain names are published in these files.

DMARC report providers

The existing DMARC report provider page stays as it is.

Domain-level detail, corrections and right of reply

Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.

We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.

Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.

Custom sector cuts, dataset refreshes or white-label reports for domains you're authorised to check are available as one-off paid work at a fixed quote. Outputs are files you keep; we hold no data.