Singapore local service businesses: where website enquiries leak

1. Submit your own website form from your phone, on mobile data, with an email address you do not use for the business. Did the notification arrive? Did it land in spam? Did the customer copy (if any) arrive?
2. Do the same at 10 pm on a weekday. Note who sees it, and when.
3. Open your domain in a free DMARC/SPF lookup. Do you have exactly one SPF record? Is there a DMARC record, and is it still p=none after months?
4. Check where form notifications go. Is it a shared inbox someone still reads, or the address of a staff member who left?
5. Click your WhatsApp button and your phone link on a phone. Do they open the right number?
6. Load your homepage on mobile data. If it takes more than a few seconds to show anything, visitors leave before they reach the form.
7. If you use a CAPTCHA, try the form in a private browser window. Can you get through it?
8. Write down how long your last five enquiries waited for a first human reply.

If any step fails or you cannot tell, that is where enquiries can go quiet.

Sample. We took outbound links to business websites from 25 public “best of Singapore” listicles and directory pages across nine service categories, removed platforms, media, marketplaces and large multinationals, and deduplicated by domain: 202 candidate domains. A site counts as Singapore if it is on a .sg domain or its homepage mentions Singapore. 183 sites qualified (131/183 on .sg). By category (the list a site was first found in): moving 50, cleaning 46, aircon 36, beauty 13, dental 12, physio 8, electrical 7, plumbing 6, renovation 5.

DNS. Public DNS-over-HTTPS (Google, Cloudflare as fallback): A, MX, TXT for SPF, and TXT at _dmarc for DMARC policy.

Web. Per site: one request for robots.txt, obeyed, then one GET of the homepage over HTTPS (HTTP only if HTTPS could not connect at all), following up to five redirects, at least 2 seconds between requests to the same site. Form detection uses the homepage HTML only: a <form> tag or a known embedded form widget. Form action hosts were checked in DNS. No contact pages were fetched, no form was submitted, no email was sent and no mail server was contacted.

Privacy. The dataset stores no email addresses, phone numbers or names, only yes/no flags and timings. Published data replaces domains with opaque IDs.

Dropped metric. We also tried to check whether email domains printed on the homepage have MX records. Our text pattern picked up non-email strings (for example script version tags), so that metric is not reported.

• Passive only. No form was submitted, so we cannot say whether any form actually delivers enquiries.
• Missing DMARC is a risk, not a fault. Many domains with no DMARC record still receive and send mail fine. It raises the chance of spoofing and spam filtering; it does not prove loss.
• Timing varies. One request per site, from the United States, on one morning. A repeat run will give different times.
• Convenience sample. Sites listed in “best of” articles, skewed towards moving, cleaning and aircon. Not representative of all Singapore businesses.
• Homepage only. Forms that live on a contact page, or that are drawn by JavaScript after load, are not counted; the true share of sites with a form is likely higher. Form action URLs were not requested, so a form posting to a dead page on a live host is not detected.
• Bot challenges. Some hosts answered with a challenge or error page; those homepages are excluded from page metrics but kept in DNS metrics.