On 31 October 2026 we scanned 183 Singapore local service business websites from the outside: aircon, cleaning, moving, dental, beauty, physio, plumbing, electrical and renovation. For each site we read public DNS and fetched the homepage once. We submitted no forms and sent no email.

This is a convenience sample. The sites were taken from public "best of Singapore" lists, so it does not represent all Singapore businesses. No business is named.

Email authentication (N = 183 domains)

  • 155/183 (84.7%) have no enforced DMARC policy: 79/183 (43.2%) have no DMARC record and 76/183 (41.5%) use p=none.
  • 21/183 (11.5%) use p=quarantine and 7/183 (3.8%) use p=reject.
  • 30/183 (16.4%) have no SPF record. 117/183 (63.9%) end SPF with ~all or ?all, and 1/183 publishes two SPF records.
  • 169/183 (92.3%) publish MX records. Of those, 142/169 (84.0%) have no enforced DMARC, and 15/169 (8.9%) have neither SPF nor DMARC.

Missing DMARC is a risk, not a confirmed fault. It makes spoofing easier and spam filtering more likely. It does not prove that any mail is being lost.

Homepage and forms (N = 170 readable homepages)

13 homepages returned an error or a bot-challenge page, so these numbers use the 170 that returned readable HTML.

  • 178/183 (97.3%) served the homepage over valid HTTPS without an error. 5/183 (2.7%) returned a 5xx error on our single request.
  • 88/170 (51.8%) have a form on the homepage.
  • 62/170 (36.5%) have neither a form nor a mailto: link on the homepage. 99/170 (58.2%) link to WhatsApp.
  • 0/88 homepage forms post to a host that doesn't resolve. 3/88 post to another host, and all of those hosts resolve.
  • 75/88 (85.2%) of sites with a homepage form have no enforced DMARC.
  • Median time to first byte was 1.24 s (p75 2.13 s). That's one run from a US server, so treat it as rough.

Limitations

  • The scan is passive, so it can't show whether any form actually delivers enquiries.
  • Only homepages were checked. Forms on contact pages, or forms drawn by JavaScript, were missed.
  • Timings come from a single run and will vary.
  • The sample leans toward moving, cleaning and aircon businesses.

Self-check for owners

  1. Submit your own form from a phone on mobile data. Does the notification arrive, and is it in spam?
  2. Look up your domain's SPF and DMARC records. You should have exactly one SPF record. Has DMARC sat at p=none for months?
  3. Check that form notifications go to an inbox someone still reads.
  4. Tap your WhatsApp and phone links and check they open the right number.

The full method, every metric as x/N, and the CSV column behind each number are on the report page.

If you want the whole path traced, the Lead Leak Check ($197) maps it from the form to the first human reply. A Starter build ($497) sets up one production workflow.