441 Service FinderList your business
← All tools

Free check

Can someone send email as your business?

Scams that borrow trusted Bermuda names have been in the news all year. Three public records decide whether a fake email from your address reaches a customer's inbox. Check yours in ten seconds.

For example yourfirm.bm or accounts@yourfirm.com.bm. We don't keep what you type.

This check reads public DNS records only. It doesn't test your mail server, passwords or computers, and a good result here is not a full security review.

What these records do
  • SPF A list of the services allowed to send email for your domain, such as Google or Microsoft. Mail from anywhere else can be treated as suspect.
  • DMARC Your instruction to every mail server about email that fails the checks: deliver it anyway (none), put it in spam (quarantine) or refuse it (reject). This is the record that stops impersonation.
  • DKIM A digital signature your provider adds to every message, which shows it wasn't altered on the way.
  • Why it matters now Butterfield, HSBC, BELCO and the BMA have all warned the public this year about scams using their names. A message that appears to come from a name people trust is one of the commonest ways those scams start.
How we got the island figure
  • We took every business website in 441 Service Finder's listing data and on the Bermuda Chamber of Commerce member list, removed social media and website-builder addresses, and kept the domains that receive email.
  • For each one we read the same public DNS records any mail server reads before accepting a message. We didn't contact or test any business.
  • "Can be impersonated" means no DMARC policy, or a policy that only monitors. The sample is not a random survey of every Bermuda business.
  • We publish the totals only and never name a business.
Sources