A Nezaam review
The first name on this list is ours.
We look at websites for things that are public, free to check, and that nobody has checked. Here is what we found. We started at home, which is the only honest place to start.
Three findings, all ours, all true this morning. Any of them takes about thirty seconds to check and you can check them on us.
Then we checked twenty-three more.
Twenty-three UK accounting and tax software companies, looked up on 18 September 2026. Public records, free tools, about half a minute each. We were not hired to do this and nobody asked us to.
21/23
publish no DMARC record at all
2/23
publish one that enforces nothing
23/23
so every single one enforces nothing
We are one of the two. That is row 01, and it is why it is row 01. A company that reviews websites and had not enforced its own is not a company you should take on trust, so we put it at the top rather than waiting to be asked.
Row 01, opened
What that line actually means.
DMARC is a short record a domain publishes saying what a receiving mail server should do with a message that claims to come from you but fails the checks.
It has three settings. p=reject means refuse it. p=quarantine means put it in spam. p=none means deliver it anyway and send us a report about it.
So a domain at p=none is not protected. It is watching. Somebody can send an invoice that says it is from that company, and the receiving server has been told, by that company, not to stop it.
What it cannot tell you. This says nothing about whether anyone has ever done it, and nothing about how good their security is anywhere else. It is one record, it is public, and it is the cheapest thing on this page to fix.
Row 03, drawn to time
Time to first byte, same connection, same minute. Ten times, on two of our own addresses. Nobody had measured either of them until we wrote this page.
None of that was hidden.
Nothing above needed a password, a tool you have to buy, or permission from anybody. Every line of it was sitting in public, free to read, for years. The owners had looked at those websites a thousand times.
Nothing was done to the stone between those two photographs. The light moved. Conservators call it raking light, a lamp brought down almost level with the surface, and it is how you look at something everybody has already looked at.
Ask it before you ask us.
Put in what you do and where you are, and we will write the sentence somebody types about your business. Then go and ask it yourself. We cannot tell you what it will answer and neither can anybody else. It moves with the model, with the wording, and from one person to the next. That is exactly why it is worth looking.
I need a plumber in Stockport. Who would you recommend?
What never goes on the sheet.
Every one of the twenty-three above is a real company and not one of them is named here. The same will be true of you, which is the only reason it is safe to let anybody look.
Your permission, in writing, first
Nothing starts on a conversation. We agree what we may look at and what we may not, and the second list is the longer one.
Only what you own
Not your host, not your card processor, not whoever sends your email. Those belong to somebody else and were never ours to read.
The quietest check that answers it
We confirm the thing and stop there. Nobody needs to prove how much further they could have gone.
Yours, and nobody else’s
What we find is written for you. It is not a case study, it does not appear on this website, and it is not a name we drop in a meeting.
The last row is empty.
Your website is not on this sheet. That is not because it passed.