On 14 September 2026 we switched on three things for otomoai.com.my: a signature on every email we send, a stricter rule for what happens to email that fails a check, and a signed lock on the domain name itself. None of this changes how the site looks. All of it changes whether an inbox can tell a real email from us apart from a fake one.
Why this matters for a small business
Nothing stops a stranger from typing "otomoai.com.my" into the From field of an email they send from their own server. Email was not built to check who a message really came from. The usual attack this enables is a spoofed invoice: a message that looks like it is from a supplier or a director, asking for a bank transfer or a change to payment details. MyCERT, the Malaysian government's cyber emergency response team, recorded 1,067 phishing incidents in the third quarter of 2025 alone, about 70.2% of the 1,521 fraud cases it logged that quarter. The three DNS records below are how a receiving mail server checks whether a message claiming to be from otomoai.com.my was actually sent by us, and what to do with it if it was not.
The same records affect whether the invoices, booking confirmations and follow-ups sent by an AI workflow automation land in the inbox or in spam.
The three email records
| Record | What it does | Our value |
|---|---|---|
| SPF | Lists which mail servers are allowed to send email that claims to be from the domain. | v=spf1 include:_spf.google.com ~all |
| DKIM | Attaches a digital signature to each email, so a receiving server can check the message was not altered after it left us. | 2048-bit RSA key at google._domainkey.otomoai.com.my. Signing was switched on today; Google can take up to 48 hours to confirm it. |
| DMARC | Tells a receiving server what to do with a message that fails both SPF and DKIM, and where to send a report about it. | v=DMARC1; p=quarantine; rua=mailto:enquiry@otomoai.com.my; adkim=r; aspf=r |
Mail sent by the product itself (outreach messages and booking confirmations) goes out from a subdomain with its own SPF value and its own DKIM key, kept separate from the main domain's mailbox traffic. That separation is deliberate: a problem with one should not be able to affect the other.
DNSSEC
The three records above only work if a receiving server can trust the DNS answer it gets when it looks them up. Ordinary DNS has no way to prove an answer was not altered in transit: an attacker sitting between the resolver and the server could, in principle, forge a reply and redirect where a query, or an email, actually goes. DNSSEC closes that gap by having every DNS record signed, so a resolver can verify the signature rather than trust the answer on faith. The otomoai.com.my zone is signed by our DNS provider using algorithm 13 (ECDSA P-256 with SHA-256). The chain of trust runs up to a DS record (key tag 2371, digest type 2) published at the .com.my registry through our registrar. That record is what tells a resolver "trust the signature you find at otomoai.com.my". As of today, public resolvers validate that chain and set the AD (Authenticated Data) flag on answers for the domain.
The internet.nl results
internet.nl is a free testing tool run by the Dutch Internet Standards Platform, a joint effort of the Dutch government and the Dutch internet community. We ran both of its tests against otomoai.com.my today.
| Category | Result |
|---|---|
| IPv6 | Passed |
| DNSSEC | Passed |
| HTTPS/TLS | Failed: three cipher-related subtests (cipher suites, cipher suite order, hash function for key exchange) |
| Security options | Warning: one or more recommended (not required) security options not set |
| RPKI | Passed |
| Category | Result |
|---|---|
| IPv6 | Passed |
| DNSSEC | Failed: not every domain involved in mail delivery is signed |
| DMARC, DKIM and SPF | Passed |
| STARTTLS and DANE | Failed: insufficiently secured connection to the receiving mail server |
| RPKI | Passed |
The two failed mail categories are about the mail servers Google Workspace runs for us, not about the otomoai.com.my zone we control: internet.nl checks DNSSEC and STARTTLS/DANE on every domain involved in delivering the mail, including Google's own receiving servers, and those are outside our settings. The failed website category is a cipher configuration matter on the webserver in front of otomoai.com.my, separate from the email and DNSSEC work above.
How to check this yourself
- Run the same two tests we did: the website test and the email test at internet.nl.
- Look up the records directly with
dig:dig TXT otomoai.com.my +shortfor SPF,dig TXT google._domainkey.otomoai.com.my +shortfor DKIM, anddig TXT _dmarc.otomoai.com.my +shortfor DMARC. To check DNSSEC validation, rundig +dnssec otomoai.com.my Aand look for theadflag in the reply. - Use MXToolbox for a plain-language read-out of the same records, or Google's own Admin Toolbox Dig tool.
What this is not
- These records do not stop phishing from a look-alike domain, such as "otomo-ai.com.my" or "otomoai.com". They only prove or disprove whether a message claiming to come from otomoai.com.my itself really did.
- Our DMARC policy is
p=quarantine, notp=reject. A message that fails the check is sent to spam rather than dropped outright. We started at quarantine rather than reject because reject can silently drop a real email if a setting is misconfigured somewhere in the chain; quarantine gives us the DMARC reports needed to check that everything lines up before moving to the stricter setting. - DKIM signing was switched on today. Google's own documentation says confirmation can take up to 48 hours, so it is fair to call this pending rather than settled.
- Every figure and score on this page is a result read at one point in time, 14 September 2026. A test run tomorrow, or a setting changed by us or by Google afterwards, can produce a different result.
Sources
- RFC 7208, "Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1," April 2014. https://www.rfc-editor.org/rfc/rfc7208
- RFC 6376, "DomainKeys Identified Mail (DKIM) Signatures," September 2011. https://www.rfc-editor.org/rfc/rfc6376
- RFC 7489, "Domain-based Message Authentication, Reporting, and Conformance (DMARC)," March 2015. https://www.rfc-editor.org/rfc/rfc7489
- RFC 4033, "DNS Security Introduction and Requirements," March 2005. https://www.rfc-editor.org/rfc/rfc4033
- internet.nl, About page: an initiative of the Dutch Internet Standards Platform (the Dutch government and the Dutch internet community). https://internet.nl/about/
- internet.nl, website test result for otomoai.com.my (score 95%), retrieved 14 September 2026. https://internet.nl/site/otomoai.com.my/4298297/
- internet.nl, email test result for otomoai.com.my (score 77%), retrieved 14 September 2026. https://internet.nl/mail/otomoai.com.my/2036816/
- Google Workspace, "Set up DKIM to prevent email spoofing": states that after adding a DKIM key, it can take up to 48 hours for DKIM authentication to start working. https://knowledge.workspace.google.com/admin/security/set-up-dkim
- MyCERT, Cyber Incident Quarterly Summary Report, Q3 2025: 1,067 phishing incidents reported, about 70.2% of the 1,521 fraud cases logged that quarter. https://www.mycert.org.my/portal/advisory?id=SR-032.012026
·