Who reads your DMARC reports?

On 29 October 2026 we looked at the public DNS of 366 UK local council email domains. 94 of them (25.7%) send their DMARC aggregate reports to at least one DMARC or email-security cloud provider headquartered in the US or owned by a US/global parent. We name no councils and no providers. These are observations, not accusations.

Why this matters

DMARC tells receiving mail servers what to do with mail that fails authentication. It also asks them to send daily aggregate reports to the address in the rua= tag. Those reports list the IP addresses that sent mail claiming to be your domain, with message counts and pass/fail results. In practice that is a map of your mail suppliers and their volumes, plus any spoofing attempts.

Many organisations pass these reports to a third-party service to analyse, which is reasonable. But the destination is a supplier decision, and it is often made once in a DNS record and then forgotten.

What we observed (29 Oct 2026)

357 of the 366 domains publish a DMARC record, and 353 publish a rua address. Many list several, so the tiers overlap.

Of the 94, 69 send reports to at least one provider whose head office we record as in the US. The other 25 use solely providers we class with this group because of a US/global parent or US operations. Wales and Northern Ireland are small samples, so their percentages move a lot with one or two councils. EU-region hosts of two US-HQ providers our taxonomy recognises (15 domains) are counted by parent company; leaving them out would put this group at 81. Hostnames our taxonomy does not yet attribute are left unclassified rather than guessed. A hostname tells you where a server might be. It doesn't tell you which company, or which country's law, sits behind it.

This is not a finding of non-compliance. Whether sending these reports abroad is a restricted transfer under UK GDPR Chapter V depends on whether they contain personal data and on each contract's safeguards (for example the UK–US data bridge or an IDTA). Many of these councils will already have that documented. Our point is narrower: it is a third-party dependency that belongs on a supplier register, with a written decision.

Method

• List: mySociety's open-data list of current UK local authorities (v1.6.1), fetched 29 Oct 2026, excluding combined and strategic authorities (382 councils). We matched each council to its website domain from the public GOV.UK local-authority API. 369 councils resolved to a domain, and 3 domains are shared, which leaves 366 unique domains.
• Query: one _dmarc TXT lookup per domain over DNS-over-HTTPS to Cloudflare’s public resolver (1.1.1.1), at a low, paced rate. Public DNS alone. We made no connections to council servers.
• Classification: we pulled every rua destination domain and classified it by the receiving organisation's headquarters, using our own dated classification (T0–T5, version 2.2, 28 Oct 2026). Where a domain uses several destinations, it counts in every tier it uses.
• Reproduce it: the classifier and aggregate CSV are open source (AGPL-3.0) at github.com/FaultyPacket/dmarc-rua-classifier.

Limits

• This is a snapshot from 29 Oct 2026. DNS changes all the time.
• We treat each council's website domain as its email domain. 10 domains had no MX record, so those councils probably receive mail on another domain.
• The headquarters classification is our own and is indicative. Acquisitions change it, and 25 domains used destinations we could not classify.
• We can see where reports are addressed. We can't see where they are processed or stored, or what contracts cover them.
• Whether aggregate reports are personal data is debated. We take no legal position.

Where do your reports go?

FaultyPacket's free scan reads your domain's public DNS and runs 20 checks across DMARC, SPF, MTA-STS, TLS-RPT, BIMI and DNSSEC. You don't need to sign up.

Run the free scan →

© 2026 FaultyPacket™ · UK/EU DNS and email security · Published October 2026 · All figures observed 29 Oct 2026