FaultyPacket research · Observed in public DNS on 29 October 2026

Who reads your DMARC reports?

On 29 October 2026 we looked at the public DNS of 366 UK local council email domains. 94 of them (25.7%) send their DMARC aggregate reports to at least one DMARC or email-security SaaS provider headquartered in the US or owned by a US/global parent. We name no councils and no providers. These are observations, not accusations.

Why this matters

DMARC tells receiving mail servers what to do with mail that fails authentication. It also asks them to send daily aggregate reports to the address in the rua= tag. Those reports list the IP addresses that sent mail claiming to be your domain, with message counts and pass/fail results. In practice that is a map of your mail suppliers and their volumes, plus any spoofing attempts.

Many organisations pass these reports to a third-party service to analyse, which is reasonable. But the destination is a supplier decision, and it is often made once in a DNS record and then forgotten.

What we observed (29 Oct 2026)

357 of the 366 domains publish a DMARC record, and 353 publish a rua address. Many list several, so the tiers overlap.

Where reports go	Domains	Share of 353 with rua
Self-hosted (the council's own domain)	171	48.4%
UK government reporting service	239	67.7%
Bundled infrastructure (email-sending or DNS/CDN provider)	26	7.4%
UK/EU-headquartered DMARC SaaS	40	11.3%
US-headquartered or US/global-parent DMARC SaaS	94	26.6% (25.7% of all 366)
Unclassified	25	7.1%

Nation (29 Oct 2026)	Domains	Send rua to a US-HQ or US/global-parent SaaS
England	301	24.9% (75)
Scotland	32	25.0% (8)
Wales	22	31.8% (7)
Northern Ireland	11	36.4% (4)

Of the 94, 69 send reports to at least one provider whose head office we record as in the US. The other 25 use only providers we class with this group because of a US/global parent or US operations. Wales and Northern Ireland are small samples, so their percentages move a lot with one or two councils. EU-region hosts of providers our taxonomy recognises (ag.eu.dmarcian.com and ag.eu.dmarcly.com, 15 domains) are counted by parent company; leaving them out would put this group at 81. Hostnames our taxonomy does not yet attribute, such as ag.dmarcian-eu.com and rua.agari-eu.com, are left unclassified rather than guessed. A hostname tells you where a server might be. It doesn't tell you which company, or which country's law, sits behind it.

This is not a finding of non-compliance. Whether sending these reports abroad is a restricted transfer under UK GDPR Chapter V depends on whether they contain personal data and on each contract's safeguards (for example the UK–US data bridge or an IDTA). Many of these councils will already have that documented. Our point is narrower: it is a third-party dependency that belongs on a supplier register, with a written decision.

Method

List: mySociety's open-data list of current UK local authorities (v1.6.1), fetched 29 Oct 2026, excluding combined and strategic authorities (382 councils). We matched each council to its website domain from the public GOV.UK local-authority API. 369 councils resolved to a domain, and 3 domains are shared, which leaves 366 unique domains.
Query: one _dmarc TXT lookup per domain over DNS-over-HTTPS to Cloudflare’s public resolver (1.1.1.1), at a low, paced rate. Public DNS only. We made no connections to council servers.
Classification: we pulled every rua destination domain and classified it by the receiving organisation's headquarters, using our own dated classification (T0–T5, version 2.2, 28 Oct 2026). Where a domain uses several destinations, it counts in every tier it uses.
Reproduce it: the classifier and aggregate CSV are open source (MIT) at github.com/FaultyPacket/dmarc-rua-classifier.

Limits

This is a snapshot from 29 Oct 2026. DNS changes all the time.
We treat each council's website domain as its email domain. 10 domains had no MX record, so those councils probably receive mail on another domain.
The headquarters classification is our own and is indicative. Acquisitions change it, and 25 domains used destinations we could not classify.
We can see where reports are addressed. We can't see where they are processed or stored, or what contracts cover them.
Whether aggregate reports are personal data is debated. We take no legal position.

Where do your reports go?

FaultyPacket's free scan reads your domain's public DNS and runs 20 checks across DMARC, SPF, MTA-STS, TLS-RPT, BIMI and DNSSEC. You don't need to sign up.

Run the free scan →

FaultyPacket · UK/EU DNS and email security · Published October 2026 · All figures observed 29 Oct 2026