FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 3,678,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
RFC 7208 SPF Lookup Tree Engineering · Credit: Adam Tucker / FaultyPacket Observatory

Fixing the RFC 7208 SPF 10-Lookup Ceiling (`PermError`) & Stopping Gmail `550-5.7.26` Drops Without Monthly SaaS Fees

Every include:, a, mx, ptr, exists, and redirect modifier in your SPF TXT record consumes part of your strict 10-DNS-lookup budget under RFC 7208 Section 4.6.4. Exceeding 10 lookups triggers an immediate SPF PermError—causing Gmail and Microsoft 365 to fail SPF authentication.

1. Why Dynamic "Hosted SPF Macros" Lock You Into Recurring SaaS Fees

Many US DMARC SaaS vendors sell recurring "hosted SPF flattening macros" that break the moment you cancel your subscription. As demonstrated by Adam Tucker and the FaultyPacket Internet Mail Security Observatory, 99% of UK & EU SMEs can stay permanently under <=10 lookups in their own DNS zone at £0/mo by:

; Before (14 Lookups -> RFC 7208 PermError + SoftFail ~all)
"v=spf1 a mx include:spf.protection.outlook.com include:_spf.google.com include:servers.mcsv.net include:sendgrid.net include:spf.mandrillapp.com ~all"

; After (6 Lookups -> RFC 7208 Compliant + Subdomain Segmentation + HardFail -all)
; Root domain (@) keeps only core corporate mail & transactional gateways:
"v=spf1 include:spf.protection.outlook.com include:sendgrid.net -all"
; Marketing / newsletter senders move to mail.yourdomain.co.uk with their own 10-lookup budget!

Run Your Free 20-Lookup Browser Scan or Grab a £5–£39 Copy-Paste Fix Pack

Test your domain in 60 seconds with zero server-side PII retention using the FaultyPacket 20-Lookup SuperTool, or download our instant offline remediation packs (with Verified Before/After DNS Certificate & Boss/DPO KPI Victory Memo).

Launch Free 20-Lookup SuperTool → View £5 Starter / £12 WP / £19 NIS2 / £24 DMARC / £29 CE v3.3 / £39 Bundle → 24h Async Fiverr Fulfilment →

Frequently Asked Questions

How do I count my nested SPF DNS lookups right now?

Paste your domain into the free FaultyPacket 20-Lookup Browser SuperTool at https://faultypacket.co.uk/#scanner to recursively walk your SPF tree via Cloudflare 1.1.1.1 DoH.

What is the difference between ~all (SoftFail) and -all (HardFail)?

SoftFail (~all) marks unauthorized senders as suspicious, whereas HardFail (-all) explicitly instructs receiving gateways that no other IP is authorized to send on behalf of your root domain.