Message verification
Did that email really come from us?
We assess critical infrastructure, so we are a name worth impersonating. This page is how you check — without having to take our word for it.
We never ask for any of this.
If a message claiming to be from Wardhelm does any of the following, it is not from us. There are no exceptions, and no urgent situation that creates one.
Credentials
Unrequested attachments
Changed bank details
Remote access
Network activity before signature
Urgency
Check the message, not the signature block.
A logo, a job title and a signature can all be copied from one genuine email. Cryptographic alignment cannot. Our domain publishes a strict policy, and every one of these facts is checkable by you, from outside, without contacting us.
1 · The sending domain
2 · The signature on it
3 · The alignment
4 · Our published policy
dig +short TXT _dmarc.wardhelm.com
It publishes p=reject, so a receiver that enforces DMARC should refuse a forgery before it reaches you.
Two honest limits. First, p=reject protects our exact domain — it cannot stop someone registering a look-alike such as a capital-I or an rn for m, so read the sender domain character by character. Second, whether a forgery is actually refused depends on your own mail system enforcing DMARC; we publish the policy, your gateway decides to honour it.
Confirm out-of-band, then tell us.
Use a number or address you already hold for us from a previous signed document — never one supplied inside the message you are questioning. That single habit defeats almost every impersonation attempt, including ones far better built than the message that brought you here.