Transparent by design
How we score your domain
Each report starts at 100. Confirmed findings subtract the amounts below, with a floor of zero. The same rule is counted at most once. Category scores use the same deductions within each category; they are not averaged to produce the overall score.
Ratings and coverage
90–100 is Excellent, 75–89 is Good, 50–74 Needs Attention, and 0–49 is Critical. If every check is unknown, the rating is Incomplete. Unknown checks do not lose points, so always read the coverage count beside the score. A high score with missing evidence is not an assurance of security.
| Finding | Points deducted |
|---|---|
| Ssl Invalid | −30 |
| Https Unavailable | −20 |
| Website Unavailable | −20 |
| Dmarc Missing | −12 |
| Spf Missing | −12 |
| Spf Multiple | −8 |
| Domain Expires ≤ 7 Days | −20 |
| Domain Expires ≤ 30 Days | −10 |
| Ssl Expires ≤ 7 Days | −15 |
| Ssl Expires ≤ 30 Days | −7 |
| Hsts Missing | −3 |
| Csp Missing | −2 |
| Nosniff Missing | −1 |
| Dnssec Missing | −2 |
Warnings are not all equal
Some findings prompt a review without deducting points. A non-mailing domain, intentionally absent IPv6 record or monitoring-only DMARC policy may be appropriate for its purpose. Severity labels help prioritize review, while the technical details explain the exact evidence.
What this scan does not establish
We do not test inbox placement, SMTP delivery, malware, all TLS ciphers, a complete DNSSEC trust chain, or historical uptime. HTTP response time is measured through response headers, not a complete browser page load. SPF includes receive limited analysis and DKIM requires a known selector.
Safe, bounded observations
Scans use public DNS, registry RDAP, and normal HTTP/TLS requests. Internal destinations are blocked, redirects and response sizes are limited, and recent results may be reused for five minutes. Results reflect the scanner's network location and time of observation.