Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
← Back to FaultyPacket Live Scanner & StoreInteractive Evidence Lab (v1.1)ICO / UK GDPR Privacy & AS-IS Terms (£0–£39 Liability Cap)Buy £24 Remediation Pack (or £39 4-Pack Bundle) →
💳 Pay with Visa, Mastercard or Amex via PayPal Guest Checkout (no PayPal account required) — or via Fiverr ($15 Launch Special with Apple Pay / Google Pay / Corporate Card) · Instant ZIP + VAT/Sole-Trader Receipt · 100% Money-Back Guarantee
FAULTYPACKET UK SECURITY & COMPLIANCE AUDITOR v1.0

Board & Executive Domain Security Posture Report

Generated on 25 October 2026 • 00:48 BST/GMT • Aligned with UK Cyber Essentials v3.3 ("Danzell"), NCSC Email Security & Oct 2026 PHP Advisory
PORTFOLIO AVERAGE
56 / 100
5 Domain(s) Audited
CONTROLLED EVIDENCE LAB & SAMPLE-REPORT VIEWER (v1.1) · ZERO LIVE NETWORK CALLS

Animated Evidence Lab: Why Transport Errors Must Never Become Missing-Record Findings

Select any of the 4 controlled DNS-over-HTTPS fixtures below to step through 1. Request → 2. Response → 3. Interpretation → 4. Report. This demonstrates how FaultyPacket's evidence-aware DoH engine separates transport/resolver failures (Timeout / SERVFAIL / NXDOMAIN) from genuine missing records (Status: 0 with empty Answer).

1. RequestDoH query sent
2. ResponseTransport or DNS RCODE
3. InterpretationEvidence state classification
4. Report OutputCustomer-facing wording
Naive Lookup Pattern (Error Collapsed to []) FALSE MISSING FINDING
1. Request
GET /dns-query?name=_dmarc.supplier-example.co.uk&type=TXT
2. Raw Response
fetch() rejected: AbortError / network timeout after 5000ms
3. Helper Return Value
catch(e) { return []; } // Collapses transport failure into empty list
4. Resulting Report Row
Score: 0/100 · Status: MISSING (_dmarc) · Action: 30-DAY NOTICE (Overstates evidence)
FaultyPacket Evidence-Preserving Pattern (Live) EVIDENCE SEPARATED
1. Request
GET /dns-query?name=_dmarc.supplier-example.co.uk&type=TXT (Cloudflare + Google DoH fallback)
2. Raw Response
Both resolvers failed or timed out: AbortError / network timeout
3. Structured Evidence State
{ state: "error", reason: "network/fetch failure", records: [] }
4. Resulting Report Row
Score: UNASSESSED · Status: EVIDENCE UNAVAILABLE (Lookup failed — retry) · Action: RETRY LOOKUP
SAMPLE-REPORT EVIDENCE BOUNDARY VIEWER · OBSERVED VS. INTERPRETATION VS. NOT ESTABLISHED

How Every FaultyPacket Audit Card Separates Public Observation from Internal Assurance

Every finding in our sample reports and Python CLI auditors explicitly distinguishes what was observed publicly, how it is interpreted, and what cannot be established without authenticated internal review:

DMARC Policy Published at Monitoring Only (p=none) OBSERVED WEAKNESS
Observed (Public DNS TXT)_dmarc.example.co.uk TXT "v=DMARC1; p=none; rua=mailto:[email protected]" (DNS Status: 0 NOERROR).
Technical InterpretationAggregate reports are requested, but unauthenticated messages failing SPF/DKIM alignment are not quarantined or rejected by receiving gateways under DMARC policy.
Not Established by Public LookupDoes not prove whether downstream mail gateways apply custom inbound anti-spoofing rules or whether all third-party senders have completed DKIM onboarding.
DNS Lookup Failure / Resolver SERVFAIL on _mta-sts EVIDENCE UNAVAILABLE
Observed (DoH Transport / RCODE)DNS response returned Status: 2 (SERVFAIL) or timed out across primary and fallback DoH resolvers.
Technical InterpretationMarked UNASSESSED — LOOKUP FAILED, RETRY. No compliance deduction or 0/100 score is assigned until an authoritative Status: 0 response is obtained.
Not Established by Public LookupNeither the presence nor the absence of _mta-sts is established during a resolver failure.

faultypacket.co.uk

Mail Gateway: Cloudflare Email Routing + Resend DKIM • Audited: 2026-10-26 17:45 UTC
GRADE A+
100 / 100
Control AreaCompliance StandardStatus & Assessment
DMARC Policy (_dmarc)NCSC / Cyber Essentials v3.3 ("Danzell")PASS: Enforced (p=reject) + RUA Reporting
v=DMARC1; p=reject; rua=mailto:[email protected]
SPF Record (v=spf1)RFC 7208 / NCSCPASS: Strict HardFail (-all) • 2/10 DNS mechanisms
v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com -all
SMTP TLS (MTA-STS / TLS-RPT)RFC 8461 / RFC 8460PASS: Enforced (mode: enforce, max_age: 604800)
/.well-known/mta-sts.txt (STSv1, mode: enforce) + _smtp._tls RUA active
CAA Certificate LockRFC 8659 BaselinePASS: Locked (Cloudflare / Let's Encrypt / Google Trust Services)
HTTPS & TLS TransportUK GDPR Art. 32PASS: OK (TLSv1.3, HTTP 200)
HSTS HeaderOWASP / NCSC TLSPASS: Enforced (max-age=63072000; includeSubDomains; preload)
CSP / Clickjacking DefenseOWASP ASVSPASS: Enforced (CSP frame-ancestors 'none' + X-Frame-Options: DENY)
PHP2Shell Exposure (CVE-2026-109618)Oct 2026 PHP RCE AdvisoryPASS: Hidden (No X-Powered-By header)

Verified Gold-Standard Reference Posture for faultypacket.co.uk:

  • All 8 external email-authentication, transport-encryption, and HTTP security header controls pass at 100/100 (Grade A+).
  • SPF uses strict HardFail (-all), DMARC enforces p=reject, HSTS preload and CSP clickjacking headers are active, and MTA-STS policy is published in enforce mode.

jflaw.co.uk

Mail Gateway: Cloud Spam Filter Gateway • Audited: 2026-10-26 17:45 UTC
GRADE B
66 / 100
Control AreaCompliance StandardStatus & Assessment
DMARC Policy (_dmarc)NCSC / Cyber Essentials v3.3 ("Danzell")PASS: Enforced (p=reject) + RUA Reporting
v=DMARC1; p=reject; rua=mailto:[email protected]
SPF Record (v=spf1)RFC 7208 / NCSCPASS: Strict HardFail (-all) • ~3/10 DNS mechanisms
v=spf1 ip4:160.153.129.223 ip4:109.68.33.0/24 include:spf.protection.outlook.com include:_spf.google.com include:email.freshdesk.com -all
SMTP TLS (MTA-STS / TLS-RPT)RFC 8461 / RFC 8460WARN: Not Configured (_mta-sts missing)   WARN: Not Configured (_smtp._tls missing)
CAA Certificate LockRFC 8659 BaselineWARN: No CAA Record (Any CA can issue certs)
HTTPS & TLS TransportUK GDPR Art. 32FAIL: <urlopen error _ssl.c:1012: The handshake operation timed ou
HSTS HeaderOWASP / NCSC TLSFAIL: MISSING (Vulnerable to SSL Stripping)
CSP / Clickjacking DefenseOWASP ASVSFAIL: MISSING (No CSP or X-Frame-Options)
PHP2Shell Exposure (CVE-2026-109618)Oct 2026 PHP RCE AdvisoryPASS: Hidden (No X-Powered-By header)

Priority Remediation Actions for jflaw.co.uk:

  • Repair HTTPS/TLS certificate configuration on port 443.
  • Add Strict-Transport-Security header (max-age=63072000; includeSubDomains; preload).
  • Add Content-Security-Policy (frame-ancestors 'self') and X-Frame-Options: SAMEORIGIN.

msbsolicitors.co.uk

Mail Gateway: Hornetsecurity Gateway • Audited: 2026-10-26 17:45 UTC
GRADE C
54 / 100
Control AreaCompliance StandardStatus & Assessment
DMARC Policy (_dmarc)NCSC / Cyber Essentials v3.3 ("Danzell")PASS: Quarantine Enforced (p=quarantine)
v=DMARC1; p=quarantine; sp=none; pct=100; rua=mailto:[email protected],mailto:[email protected]!10m; ruf=mailto:[email protected]!10m
SPF Record (v=spf1)RFC 7208 / NCSCWARN: SoftFail (~all) • ~6/10 DNS mechanisms
v=spf1 ip4:185.179.20.2 include:ciphr247.com include:spf.sendinblue.com include:spf.hornetsecurity.com include:one.zoho.uk include:spf.protection.outlook.com mx ~all
SMTP TLS (MTA-STS / TLS-RPT)RFC 8461 / RFC 8460WARN: Not Configured (_mta-sts missing)   WARN: Not Configured (_smtp._tls missing)
CAA Certificate LockRFC 8659 BaselineWARN: No CAA Record (Any CA can issue certs)
HTTPS & TLS TransportUK GDPR Art. 32PASS: OK (TLSv1.3, HTTP 200)
HSTS HeaderOWASP / NCSC TLSFAIL: MISSING (Vulnerable to SSL Stripping)
CSP / Clickjacking DefenseOWASP ASVSFAIL: MISSING (No CSP or X-Frame-Options)
PHP2Shell Exposure (CVE-2026-109618)Oct 2026 PHP RCE AdvisoryWARN: Header Exposed: Next.js, Payload

Priority Remediation Actions for msbsolicitors.co.uk:

  • Transition SPF termination from SoftFail (~all) to Strict (-all) once senders are verified.
  • Advance DMARC policy from p=quarantine to p=reject for full anti-spoofing protection.
  • Add Strict-Transport-Security header (max-age=63072000; includeSubDomains; preload).
  • Add Content-Security-Policy (frame-ancestors 'self') and X-Frame-Options: SAMEORIGIN.
  • Suppress X-Powered-By header (expose_php = Off in php.ini).

taxdriven.co.uk

Mail Gateway: Microsoft 365 (Exchange Online) • Audited: 2026-10-26 17:45 UTC
GRADE D
45 / 100
Control AreaCompliance StandardStatus & Assessment
DMARC Policy (_dmarc)NCSC / Cyber Essentials v3.3 ("Danzell")WARN: Monitoring Only (p=none — Zero Spoof Blocking)
v=DMARC1; p=none; rua=mailto:[email protected]
SPF Record (v=spf1)RFC 7208 / NCSCWARN: SoftFail (~all) • ~2/10 DNS mechanisms
v=spf1 include:spf.mailanyone.net include:spf.protection.outlook.com ~all
SMTP TLS (MTA-STS / TLS-RPT)RFC 8461 / RFC 8460WARN: Not Configured (_mta-sts missing)   WARN: Not Configured (_smtp._tls missing)
CAA Certificate LockRFC 8659 BaselineWARN: No CAA Record (Any CA can issue certs)
HTTPS & TLS TransportUK GDPR Art. 32PASS: OK (TLSv1.3, HTTP 200)
HSTS HeaderOWASP / NCSC TLSFAIL: MISSING (Vulnerable to SSL Stripping)
CSP / Clickjacking DefenseOWASP ASVSFAIL: MISSING (No CSP or X-Frame-Options)
PHP2Shell Exposure (CVE-2026-109618)Oct 2026 PHP RCE AdvisoryPASS: Hidden (No X-Powered-By header)

Priority Remediation Actions for taxdriven.co.uk:

  • Transition SPF termination from SoftFail (~all) to Strict (-all) once senders are verified.
  • DMARC is set to p=none (monitoring only). Attackers can still spoof executive emails.
  • Add Strict-Transport-Security header (max-age=63072000; includeSubDomains; preload).
  • Add Content-Security-Policy (frame-ancestors 'self') and X-Frame-Options: SAMEORIGIN.

watkinsonblack.co.uk

Mail Gateway: No MX Records Found • Audited: 2026-10-26 17:45 UTC
GRADE F
16 / 100
Control AreaCompliance StandardStatus & Assessment
DMARC Policy (_dmarc)NCSC / Cyber Essentials v3.3 ("Danzell")FAIL: MISSING (No _dmarc TXT Record)
No _dmarc TXT record published
SPF Record (v=spf1)RFC 7208 / NCSCFAIL: MISSING (Direct Domain Spoofing Risk)
No v=spf1 TXT record published
SMTP TLS (MTA-STS / TLS-RPT)RFC 8461 / RFC 8460WARN: Not Configured (_mta-sts missing)   WARN: Not Configured (_smtp._tls missing)
CAA Certificate LockRFC 8659 BaselineWARN: No CAA Record (Any CA can issue certs)
HTTPS & TLS TransportUK GDPR Art. 32PASS: OK (TLSv1.3, HTTP 200)
HSTS HeaderOWASP / NCSC TLSFAIL: MISSING (Vulnerable to SSL Stripping)
CSP / Clickjacking DefenseOWASP ASVSFAIL: MISSING (No CSP or X-Frame-Options)
PHP2Shell Exposure (CVE-2026-109618)Oct 2026 PHP RCE AdvisoryPASS: Hidden (No X-Powered-By header)

Priority Remediation Actions for watkinsonblack.co.uk:

  • Publish a strict SPF TXT record ending with '-all'.
  • Create _dmarc TXT record; roll out p=quarantine -> p=reject with rua aggregate reporting.
  • Add Strict-Transport-Security header (max-age=63072000; includeSubDomains; preload).
  • Add Content-Security-Policy (frame-ancestors 'self') and X-Frame-Options: SAMEORIGIN.
Generated by FaultyPacket DMARC, SPF, MTA-STS & PHP2Shell Remediation Pack • https://faultypacket.co.uk • Support: [email protected]
faultypacket.co.uk · X (@faultypacket) · Facebook (Sphud ✓ · /FaultyPacket) · Instagram (@faultypacket) · Fiverr (@faultypacket)