Free workshop
Stop fake emails from your business.
Thirty minutes on how criminals send email that looks like it came from you or your suppliers, the settings that make it harder, and the one office habit that stops the money moving. For business owners, with no technical knowledge needed.
Presented in partnership with BEDC
Length
30 minutes, questions included
Cost
Free
For
Owners and whoever pays the bills
Bring
Your business email domain
Who it is for
Restaurants, shops, trades, salons, consultants, small professional firms, and anyone else who sends invoices by email or pays suppliers by bank transfer. It is written for the owner and for whoever does the books, not for IT staff. If your IT person wants to come along, they are welcome, but the session will not slow down for acronyms.
What you will come away with
- 1. How criminals send email that looks like it came from your business
- 2. How fake invoices and changed bank details actually work
- 3. What SPF, DKIM and DMARC do, in plain English
- 4. Why DMARC only helps once it is set to enforce
- 5. How to check your own domain in two minutes
- 6. What to do this week, and what to hand to your IT provider
Why this, and why now
In September 2026 dotbm read the public email settings of every .bm domain we could find that accepts mail. 945 of 1,305, 72%, were not set to stop forged email using their exact address. That is a single day's snapshot of settings, not a count of businesses that were attacked, and it is a common gap well beyond Bermuda. It is also one of the cheaper gaps to close.
of 1,305 domains that accept mail
Watches, blocks nothing.
A record with no policy in it, two records where only one is allowed, or a policy receivers do not recognise, such as a misspelt "quaratine". Receivers ignore all three.
Source: State of Bermuda on the Web, dotbm's passive study of public DNS records. No domain is named in it.
Check your own domain
Type your domain and see, in plain English, whether SPF, DKIM and DMARC are set up and whether DMARC is enforcing. It reads public records only and stores nothing.
Run the check →Take the checklist
One printable page: 11 checks, why each matters, and the exact question to ask your IT provider. Written to be handed over as it is.
Download the checklist (PDF)Your IT provider can do all of this
Every item on the checklist is standard work. Take it to whoever already looks after your email, your mail provider, or anyone you trust. Microsoft and Google both publish step-by-step instructions for their own services.
If you would like a second opinion, dotbm will review your domain's public email settings for free and send you a short written report, worded so you can pass it straight to your provider. It is based on what your domain publishes, so it is not a penetration test or a full security assessment.
Who presents it
Chris Bennett, founder of dotbm, with more than thirty years of technology work in Bermuda. dotbm builds websites, payments and the systems behind them for Bermuda businesses, and ran the September 2026 study of how .bm domains are configured. The workshop is the first in a series on practical digital security for small businesses.
Bring the workshop to your group
Business associations, member groups and staff teams. Thirty minutes, in person or online, free.