Journalist one-pager: 338-domain DMARC sample, October 2026 snapshot
October 2026 snapshot, as of 31 October 2026. Next refresh due on or after 28 November 2026.
Every figure below was re-verified on the snapshot date from public DNS for the fixed list of 338 domains, using two public resolvers. Figures are recomputed at every snapshot.
Headline numbers
- In a fixed sample of 338 UK and EU organisation domains checked on 31 October 2026, 336 returned a DNS answer. Of those, 208 (61.9%) published a DMARC policy of p=reject.
- 259 of the 336 domains that answered (77.1%) asked for DMARC reports to be sent to an address outside their own domain.
- 109 of the 336 domains that answered (32.4%) asked for reports to go to an address at one of the US-headquartered organisations on the provider list.
- 36 of the 336 domains that answered (10.7%) asked for reports to go to an external address while their policy was p=none, which asks receiving servers to deliver failing mail as normal.
- 12 of the 336 domains that answered (3.6%) had no valid DMARC record on that date.
Check your own domain free in seconds →
Source: FaultyPacket 338-domain sample, October 2026 snapshot (as of 31 October 2026). CC BY 4.0.
Sample definition
A fixed, pre-declared list of 338 organisation domains (249 UK, 86 EU, 3 without a sector label), defined by the domain list of the FaultyPacket 338-domain DMARC study file published on 28 October 2026. The list is frozen: no domain is added, removed or swapped, and the run stops if the list changes. Sector and region tags come from the label each domain carries in the FaultyPacket 1,611-domain study file of 29 October 2026; the 3 domains without a label count in the overall figures and in no sector.
Exact date and method
Snapshot taken from 2026-10-31T08:03:47Z to 2026-10-31T08:10:41Z (UTC). For every domain in the fixed list, the TXT record at _dmarc.<domain> was requested from two public DNS-over-HTTPS resolvers (1.1.1.1 via cloudflare-dns.com and 8.8.8.8 via dns.google) at no more than two queries per second. Where both answered with different text, the query was repeated once; where both answered, the 1.1.1.1 answer is the one counted. Policy is the p= tag of a single valid v=DMARC1 record; no record, more than one record, or an unrecognised p= value counts as no valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=. External means a host outside the domain and its subdomains. Collector headquarters come from the FaultyPacket provider list (version T0-T5-v2.2-2026-10-28+sha9d5155ea38); a host not on the list, or a company listed with more than one headquarters region, counts as headquarters not classified. No other records, web pages, contact details or personal data were collected.
Disclaimer
Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation. US-headquartered organisations are identified from the provider list; the term describes where the company that runs the report address is headquartered, nothing more.
How this differs from the 28 October study file
The 28 October 2026 study file recorded 259 of 338 domains with an external report address. This re-verification counts 259 of the 336 domains that answered. Its headquarters split uses each listed provider's stated headquarters region, so its US-headquartered count is not comparable with the earlier file's provider grouping.
Data and links
Domain-level detail, corrections and right of reply
Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.
We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.
Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.
Custom sector cuts, dataset refreshes or white-label reports for domains you're authorised to check are available as one-off paid work at a fixed quote. Outputs are files you keep; we hold no data.