Every piece of advice about scam emails ends in the same place: check the sender. Look at the domain, make sure it is really your bank, and if it is not, delete it.
That advice assumes a bank is a domain. We checked, and for four of the six banking brands we looked at, it is not true.
What we set out to check, and what we found instead
The question we started with was whether a bank's domain can be forged outright. A domain can tell the world's mail servers to refuse forgeries, by publishing a DMARC policy of reject. If it publishes nothing, a forged message can arrive looking perfect.
We read the published records for 25 domains — twelve banking brands across the region, five government domains, and our own. The answer to our original question was reassuring: 16 of the 25 ask receivers to reject forgeries outright, and all 5 government domains do.
Then we looked at the brands rather than the domains, and the picture changed.
4 of the 6 brands we could trace to more than one domain contain domains that disagree with each other about their own protection.
The gap between the brand and the domain
Take the clearest case. uobgroup.com publishes a policy of reject: forge mail from it and a competent receiver throws the message away. uob.com.sg publishes no DMARC policy at all.
Both belong to the same bank. A customer who has learned to recognise one of them has learned nothing useful about the other.
It repeats down the list. DBS rejects on dbs.com.sg and on posb.com.sg, but only quarantines on dbs.com. OCBC rejects on ocbc.com.sg and quarantines on ocbc.com. Public Bank rejects on publicbank.com.my while pbebank.com publishes nothing.
Two brands were consistent, in opposite directions. Maybank rejects on both domains we traced. CIMB agrees with itself too — at nothing, with one domain publishing a policy that blocks nothing and the other publishing no policy at all.
This gap between brand and domain is what makes "check the sender" such weak advice. The instruction assumes you can tell a real domain from a fake one. In practice a single bank hands you several real domains, some protected and some not, and no way to tell from the outside which is which.
The domains that receive nothing and can still be forged
Two domains in the set have no mail exchanger at all: cimb.com.my and pbebank.com. Nothing is delivered to them.
That sounds like it should make them safe, and it does the opposite. A mail exchanger governs what a domain receives. Forging is about what a domain appears to send, and any domain can be used as a forged sender whether or not it accepts mail.
A domain that sends no legitimate mail is the easiest in the world to protect. It can publish reject and lose nothing. Both of these publish no policy instead.
Government did the boring thing correctly
Every government domain we checked — 5 of 5 — publishes reject. Tax, pensions, police and the two national portals.
We say it plainly because this is the group most impersonated in scams here, and because they prove it can be done. There is no technical reason a large organisation cannot enforce on all its domains. Some have.
Our own record, which is worse
This site publishes p=none. It collects reports and blocks nothing.
We put that record up on 11 August 2026, having previously published nothing at all, and it is deliberately the weakest of the three settings while we confirm our own mail is passing. That is the correct order of operations — moving to reject before you know what you send is how organisations discover they have blocked their own invoices — but it does mean we are one of the 5 unenforced domains in our own table.
We are not going to grade other people's records while quietly omitting ours.
Stop treating a familiar-looking domain as proof. A bank is not one domain, it is several, and 4 of the 6 brands we traced have inconsistent protection. Recognising one of your bank's domains tells you nothing about the next one. The good news is that outright forgery is mostly handled: 16 of 25 domains here ask receivers to reject fakes, and every government domain we checked does. The message that reaches you is therefore more likely to use a lookalike domain, which is a different problem and the one the padlock guide covers. The reliable move has not changed and does not depend on any of this: never act on a link in a message about money. Open the app you already have, or type the address you already know. And if you run a domain that sends no mail at all, publish a reject policy on it today — it costs nothing and closes the cheapest forgery there is.
Checking a domain yourself
The script is committed with this guide and reads only public DNS, so you can run it against any domain you like. Our DNS lookup shows the same records one at a time, and IP lookup answers where a domain actually points.
To go further:
- Is this email really from them explains SPF, DKIM and DMARC from the receiver's side.
- What the padlock actually proves covers the lookalike domains that survive all of this.
- What public Wi-Fi still exposes measures the other half of what a network can see.
- Every value comes from a script committed alongside this guide, reading public DNS: the SPF record and its qualifier, the DMARC record and its policy, whether a reporting address is published, and whether the domain has a mail exchanger.
- ⚠️ NO MAIL WAS SENT AND NOTHING WAS FORGED. No message was addressed to or from any domain here, and no delivery was attempted. This is a survey of records anyone can query, not a test of anyone's defences.
- ⚠️ NO DOMAIN IS BEING ACCUSED OF ANYTHING. Publishing
p=none, or no record at all, is common and is not evidence of negligence — it is frequently a deliberate stage in a rollout, which is exactly why our own domain is set that way today. - ⚠️ DKIM WAS NOT MEASURED and its absence is not implied. A DKIM key lives at a selector chosen by the sender, and selectors cannot be enumerated from outside. SPF and DMARC are what decide whether a receiver may reject a forgery, so those are what this measures.
- ⚠️ THE FIRST RUN TOOK ONE DOMAIN PER BRAND AND WOULD HAVE PUBLISHED TWO FALSE CLAIMS. It read uob.com.sg as UOB's mail domain, when uobgroup.com carries the reject policy, and cimb.com.my as CIMB's, when cimb.com is the group domain. Reading a brand as a single domain is the error the guide is about, and we made it first.
- ⚠️ A BRAND'S DOMAIN LIST IS NOT PUBLISHED ANYWHERE. The families here were assembled from mail-exchanger and SPF evidence and are certainly incomplete — a brand may use domains we did not find. A family shown as consistent may contain an unenforced domain we never saw, so "agrees with itself" means across the domains measured, not across all domains that exist.
- ⚠️ ONE MOMENT IN TIME. DNS records change, and several of these are actively being rolled out. Every figure is as published on the measurement date and a re-run may differ — which is the point of committing the script rather than only the numbers.
This describes what public DNS records say about whether a domain can be forged. It is not a security assessment of any bank or agency, not advice about a message you have already received, and not a substitute for contacting your bank through a channel you already trust.
View author profile → · Editorial policy
