What the Domain Trust Checker Tests — 34 Security Checks

How scoring works (v7)

No pillar weighting. No per-check auto-F. The grade is a flat percentage of the applicable scored points you earn — so absent infrastructure (e.g. no web stack) drops out of numerator and denominator.

The points: each scored check carries a fixed point value. The 25 scored checks total 875 points. Informational checks contribute 0 points and never move the grade.

The result outcome for each check is Pass (check is correctly configured), Warning (partial or weak configuration), Fail (missing or broken), or Informational / NA (reported for context; doesn't move the grade).

"Auto-F" myth: there isn't one. What looks automatic is structural — a domain that doesn't resolve, has no nameservers, or has a broken DNSSEC chain is never placed on the 875-point scale at all. A reachable site that fails HTTPS or certificate validity just loses those (large) point blocks and lands at F by arithmetic.

• DNS Security — 135 pts
• Email Security — 275 pts
• TLS & Certificates — 285 pts
• Web Security — 180 pts

All 34 check results explained

Grouped by category. Scored checks show their point value and a pass / fail breakdown for your business and your customers. Informational and lifecycle checks are listed for context — they don't move the grade.

DNS Security

Five DNS-layer checks. CAA controls who can issue certificates for your domain; DNSSEC and nameserver diversity stop attackers from tampering with or hijacking DNS lookups; SOA validates registry hygiene.

5 checks · 135 pts · 5 scored

CAA Record

Certification Authority Authorisation DNS record · 45 pts. A DNS record that specifies which certificate authorities are allowed to issue SSL certificates for your domain. Without it, any CA in the world could issue a certificate for your site. Pass means (for your business): Only your specified certificate authorities can issue certificates for your domain. Unauthorised certificates cannot be issued. Pass means (for your customers): Certificate mis-issuance for this domain is prevented. Fake secure versions of the site are harder to create. Fail means (for your business): Any certificate authority could issue a certificate for your domain. Rare, but exploited in targeted attacks against high-value domains. Fail means (for your customers): A malicious actor could theoretically obtain a valid certificate for a fake version of the site. Fix: Add a CAA DNS record via Cloudflare.

DNSSEC — DS Record

Delegation Signer DNS record at the parent zone · 25 pts. The DS record at your domain registrar links your domain to its DNSSEC keys. Without it, the DNSSEC chain cannot be established. Pass means (for your business): DS record is present at your domain registrar. The DNSSEC chain of trust begins here. Pass means (for your customers): The first link in the DNS security chain is in place for this domain. Fail means (for your business): DNSSEC is not anchored at the registrar level. DNS hijacking protection is not in place even if other DNSSEC records exist. Fail means (for your customers): DNS lookups for this domain are not cryptographically protected at the registrar level. Fix: Enable DNSSEC at your registrar.

DNSSEC — DNSKEY Record

DNSKEY DNS record (public key for zone signing) · 25 pts. The public key that DNS resolvers use to verify the digital signatures on your DNS records. Without it, DNSSEC verification cannot happen. Pass means (for your business): DNSKEY record is present. DNS resolvers can verify your DNS records are genuine. Pass means (for your customers): DNS resolvers can check that your domain's records have not been tampered with. Fail means (for your business): DNSKEY record is missing. DNSSEC verification is not possible even if a DS record exists. Fail means (for your customers): DNS record verification is not possible for this domain. Fix: Enable DNSSEC at your registrar and DNS provider.

Nameserver Diversity

Distinct nameserver networks for the zone · 25 pts. Whether your domain's nameservers are spread across multiple independent networks. Single-provider setups mean one provider outage takes your whole domain offline. Pass means (for your business): Your nameservers span more than one network. A single-provider outage will not take your domain offline. Pass means (for your customers): The site stays reachable even when one DNS provider has problems. Fail means (for your business): All nameservers are on the same network. A single provider outage will take your domain completely offline — email and web together. Fail means (for your customers): If your DNS provider has an outage, they can't reach the site at all. Fix: Add a secondary DNS provider.

SOA Configuration

Start of Authority DNS record sanity · 15 pts. The SOA record names the authoritative nameserver and the responsible contact for the zone. Broken SOA values are a sign of an unmanaged or misconfigured zone. Pass means (for your business): Your zone's SOA record is well-formed. Authoritative contact and refresh values are sensible. Pass means (for your customers): The domain is being managed by someone who is reachable for DNS issues. Fail means (for your business): SOA record is malformed or contains placeholder values. Operators chasing a DNS issue may struggle to reach anyone. Fail means (for your customers): DNS-side problems with this domain may not be quickly fixable. Fix: Correct the SOA via your DNS provider.

Email Security

Seven checks that protect your email domain from being impersonated by fraudsters — SPF, DKIM, and DMARC together; plus reverse DNS and the basic deliverability prerequisites.

7 checks · 275 pts · 7 scored

SPF Record

Sender Policy Framework (DNS TXT record) · 55 pts. A list that tells the world which mail servers are authorised to send email from your domain. Like a guest list at a door — anyone not on the list gets turned away. Pass means (for your business): Your domain has a valid SPF record. Only authorised mail servers can send email as your business. Pass means (for your customers): Emails appearing to come from this business are more likely to be genuine. Fail means (for your business): Anyone can send email using your domain name. Criminals exploit this for invoice fraud and phishing. Fail means (for your customers): They could receive a convincing fake email appearing to come from your business — with no way to know it is fake. Fix: Configure via Domain Fix.

DMARC Policy

Domain-based Message Authentication, Reporting and Conformance · 55 pts. The policy that tells every mail server in the world what to do when an email fails SPF or DKIM. Without it, fake emails are still delivered. With it set to reject, fakes never reach anyone. Pass means (for your business): DMARC is set to p=reject. Spoofing your domain is actively blocked at the receiver. Pass means (for your customers): Receivers are instructed to reject suspicious emails claiming to come from this domain. Fail means (for your business): Even with SPF and DKIM, without a DMARC reject policy fake emails are still delivered. Fail means (for your customers): Fake emails using this domain may still land in their inbox. Warning condition: DMARC present but policy is p=none or p=quarantine. For full protection the policy should be p=reject. Fix: Configure via Domain Fix.

SPF Policy Strength

SPF -all qualifier (hard fail) vs ~all (softfail) · 45 pts. Whether your SPF record uses hard fail (-all) or soft fail (~all). Hard fail tells receivers to reject unauthorised mail outright; soft fail only marks it as suspicious. Pass means (for your business): SPF is set to hard fail (-all). Unauthorised emails are rejected, not just flagged. Pass means (for your customers): Emails that fail SPF are rejected before they reach any inbox. Fail means (for your business): SPF is soft fail (~all). Suspicious emails are still delivered. This significantly weakens email authentication. Fail means (for your customers): Fake emails may still reach their inbox even though SPF is in place. Warning condition: Using ~all (softfail) instead of -all (hardfail). Change to -all for full protection. Fix: Configure via Domain Fix.

DKIM Record

DomainKeys Identified Mail (DNS TXT or CNAME record) · 45 pts. An invisible digital signature added to every genuine email you send. Like a wax seal on a letter — if the seal is missing or broken, the email cannot be trusted. Pass means (for your business): Every email you send carries a verifiable digital signature. Receivers can confirm it came from your systems. Pass means (for your customers): Emails from this business carry a digital signature that proves authenticity. Fail means (for your business): Your emails carry no digital signature. Fake emails are indistinguishable from real ones; your genuine emails may land in spam. Fail means (for your customers): There is no way to verify whether an email claiming to be from this business is genuine. Fix: Configure via Domain Fix.

DMARC Aggregate Reporting

DMARC rua= aggregate report URI · 25 pts. Whether your DMARC record asks receivers to send daily aggregate reports about who's sending mail as you. Without these reports you can't see attacks or misconfigurations. Pass means (for your business): You're receiving daily DMARC reports. Spoofing attempts and SPF/DKIM gaps are visible. Pass means (for your customers): Issues with mail from this domain get spotted and fixed quickly. Fail means (for your business): You can't see who's sending mail as you. Spoofing attempts go unnoticed. Fail means (for your customers): Impersonation against this domain may go undetected. Fix: Add rua= to your DMARC record.

MX Record

Mail Exchange DNS records · 25 pts. The records that tell the internet where to deliver email sent to your domain. Without them, email cannot be received. Pass means (for your business): Your domain can receive email. Basic email infrastructure is in place. Pass means (for your customers): Emails sent to this business will be received. Fail means (for your business): Email sent to your domain cannot be delivered. Customers, suppliers, and partners can't reach you by email. Fail means (for your customers): Emails sent to this business may bounce or disappear. Fix: Contact your email provider or IT support.

Reverse DNS (FCrDNS)

Forward-confirmed reverse DNS on outbound mail IPs · 25 pts. Whether your outbound mail server's IP address resolves back to its name (and that name resolves forward to the same IP). Without FCrDNS, your mail looks suspicious to receivers and lands in spam. Pass means (for your business): Your outbound mail IPs have matching forward and reverse DNS. Mail deliverability is healthy. Pass means (for your customers): Emails from this business reach the inbox, not spam. Fail means (for your business): Reverse DNS is broken or doesn't match. Many receivers will flag your mail as suspicious and may junk it. Fail means (for your customers): Emails from this business may land in their spam folder. Fix: Fix PTR records with your mail-server provider.

TLS & Certificates

Seven scored checks covering HTTPS availability, certificate validity, key strength, expiry, signature algorithm, and cipher suite strength — plus three informational checks (OCSP stapling, TLS compression, secure renegotiation) for context.

10 checks · 285 pts · 7 scored · 3 info

HTTPS Available

TLS/SSL availability on port 443 · 55 pts. The padlock in your browser. Confirms your website can be reached over an encrypted connection. Pass means (for your business): Your website is accessible over HTTPS. Visitor data is encrypted in transit. Google ranks HTTPS sites higher. Pass means (for your customers): Their connection to the website is encrypted. Fail means (for your business): Your website is served over HTTP only. Visitor data is in plain text. Google marks the site Not Secure. Fail means (for your customers): Any information they submit could be intercepted by a third party on the same network. Fix: Enable HTTPS via Cloudflare — free tier covers this fully.

TLS Version

Modern TLS (1.2+) supported, legacy (1.0/1.1) disabled · 55 pts. Which TLS protocol versions your server accepts. Modern (1.2 / 1.3) must be supported; legacy (1.0 / 1.1) should be disabled — they have known vulnerabilities. Pass means (for your business): TLS 1.2 and/or 1.3 are supported. Legacy versions are disabled. Pass means (for your customers): Their connection uses modern, secure encryption. Fail means (for your business): Legacy TLS 1.0 or 1.1 is still accepted, or TLS 1.2+ is missing. PCI DSS non-compliant. Fail means (for your customers): Their connection may use a protocol with known attacks against it. Warning condition: TLS 1.3 not yet enabled — minor; TLS 1.2 alone is still acceptable. Fix: Set minimum TLS version to 1.2 in your TLS provider.

Certificate Valid & Trusted

TLS certificate validity and chain of trust check · 55 pts. Confirms your HTTPS certificate exists, is not expired, was issued for the correct domain, and was issued by a trusted authority. Browsers show a padlock when this passes — and a red warning screen when it fails. Pass means (for your business): Your SSL certificate is valid and trusted. Visitors see the padlock and proceed without warnings. Pass means (for your customers): The site has a valid security certificate. Fail means (for your business): Visitors see a full-screen browser warning before reaching your site. Most leave immediately. Fail means (for your customers): Their browser warns them the connection is not secure. Fix: Issue or renew a valid certificate (Cloudflare free tier covers this).

Certificate Expiry

TLS certificate expiry date check (warning if < 30 days) · 45 pts. Certificates expire. When they do, browsers immediately display a red warning that stops most visitors from proceeding. This check warns you 30 days before expiry. Pass means (for your business): Certificate has more than 30 days remaining. No immediate expiry risk. Pass means (for your customers): No warnings expected soon. Fail means (for your business): Certificate has already expired or expires within days. Visitors see a browser warning; the site is effectively inaccessible. Fail means (for your customers): The site's certificate is about to expire (or has). Warning condition: Certificate expires within 30 days. Renew now. Fix: Enable automatic certificate renewal.

Certificate Signature Algorithm

Modern signature algorithm (SHA-256 or stronger) · 25 pts. Which algorithm was used to sign your certificate. SHA-1 and MD5 are broken; SHA-256 or stronger is required. Pass means (for your business): Certificate uses a modern, unbroken signature algorithm. Pass means (for your customers): Their connection's trust chain isn't built on broken cryptography. Fail means (for your business): Certificate uses a deprecated signature algorithm (SHA-1 or worse). Modern browsers may reject it. Fail means (for your customers): Their browser may refuse the connection. Fix: Reissue with SHA-256.

Certificate Key Strength

RSA key size or ECDSA curve check (minimum 2048-bit RSA / P-256) · 25 pts. Checks that the cryptographic key used in your certificate is strong enough to be considered secure by current standards. Pass means (for your business): Certificate uses a strong cryptographic key. Pass means (for your customers): The encryption protecting their connection uses a strong key. Fail means (for your business): Certificate uses a weak key. Does not meet current best practice; may trigger compliance-scanner warnings. Fail means (for your customers): The encryption key is weaker than recommended. Fix: Reissue with a stronger key.

Cipher Suite Strength

TLS cipher suite strength check (ECDHE, AES-GCM preferred) · 25 pts. Cipher suites are the specific encryption algorithms your server uses. Some older suites have known weaknesses. Pass means (for your business): Only strong cipher suites are used. Encryption meets current security standards. Pass means (for your customers): The encryption algorithm protecting their connection is strong and modern. Fail means (for your business): Weak cipher suites are enabled. May cause compliance-scan failures. Fail means (for your customers): The encryption algorithm used may have known weaknesses. Fix: Restrict to modern cipher suites in your TLS provider.

OCSP Stapling

Online Certificate Status Protocol stapling. Informational — whether your server pre-fetches and 'staples' the certificate revocation status to the TLS handshake. Faster validation, better visitor privacy. Not scored.

TLS Compression Disabled

TLS compression (CRIME mitigation). Informational — whether legacy TLS compression is disabled. Compression enables the CRIME attack. Modern stacks disable it by default. Not scored.

Secure Renegotiation

RFC 5746 secure renegotiation indication. Informational — whether your server supports the secure version of TLS renegotiation. Legacy unsecured renegotiation enables MitM injection. Not scored.

Web Security

Six scored HTTP response headers that block specific classes of web attack — HSTS, HTTPS redirect, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy — plus three informational cross-origin headers (COOP, CORP, COEP).

9 checks · 180 pts · 6 scored · 3 info

HSTS Header

Strict-Transport-Security HTTP response header · 45 pts. An instruction to browsers: always use HTTPS for this site, even if someone tries to force an insecure connection. Prevents SSL stripping attacks. Pass means (for your business): Browsers are instructed to always use HTTPS. SSL stripping cannot downgrade connections. Pass means (for your customers): Their browser always connects securely, even if an attacker tries to intercept. Fail means (for your business): Vulnerable to SSL stripping — an attacker intercepting a visitor's connection can downgrade it from secure to insecure. Fail means (for your customers): Their connection could be silently downgraded by a man-in-the-middle attacker. Warning condition: HSTS present but max-age too short. Increase to at least 31536000 (1 year). Fix: Add HSTS header via Cloudflare Transform Rules.

HTTP → HTTPS Redirect

HTTP 301 permanent redirect to HTTPS · 45 pts. When someone types your domain without https://, are they automatically redirected to the secure version? Pass means (for your business): All visitors are redirected to HTTPS regardless of how they typed the address. Pass means (for your customers): They always reach the secure version of the site. Fail means (for your business): Visitors typing http:// or following old links may use your site insecurely. Fail means (for your customers): They may access the site without encryption from old links. Fix: Enable 'Always Use HTTPS' in your CDN/origin.

Content-Security-Policy

Content-Security-Policy HTTP response header · 25 pts. A set of rules telling browsers exactly which scripts, images, and resources are allowed on your pages. Prevents attackers from injecting malicious code (XSS). Pass means (for your business): Your site restricts what can load on each page. XSS attacks are significantly harder. Pass means (for your customers): Malicious scripts cannot easily be injected into the pages they view. Fail means (for your business): Vulnerable to cross-site scripting. Attackers could inject code that steals visitor data. Fail means (for your customers): Malicious code could run in their browser while on the site. Warning condition: CSP present but uses unsafe-inline or unsafe-eval, which weakens the protection. Fix: Requires developer input to author a strict CSP.

X-Frame-Options

X-Frame-Options HTTP response header (DENY or SAMEORIGIN) · 25 pts. Prevents your site from being embedded invisibly inside another website — clickjacking, used to trick visitors into clicking things they didn't intend to. Pass means (for your business): Your website cannot be embedded inside a malicious site. Clickjacking is blocked. Pass means (for your customers): They cannot be tricked by a fake overlay placed on top of your site. Fail means (for your business): Could be embedded inside an attacker's site to steal clicks, credentials, or payments. Fail means (for your customers): Could be tricked into clicking a disguised button on what looks like your site. Fix: Add X-Frame-Options: DENY via Cloudflare Transform Rules.

X-Content-Type-Options

X-Content-Type-Options: nosniff HTTP response header · 25 pts. Prevents browsers from guessing what type of file they're looking at — a behaviour attackers exploit to execute malicious scripts disguised as harmless files. Pass means (for your business): Browsers cannot be tricked into executing malicious content via mistaken file types. Pass means (for your customers): Their browser will not execute scripts disguised as images / docs on the site. Fail means (for your business): Browser content-sniffing could be exploited to execute malicious code via your site. Fail means (for your customers): Their browser may run disguised malicious content. Fix: Add X-Content-Type-Options: nosniff via Cloudflare Transform Rules.

Referrer-Policy

Referrer-Policy HTTP response header · 15 pts. Controls how much information your website shares with other sites when a visitor clicks an outbound link. Pass means (for your business): Navigation data is not leaked to third-party sites. Pass means (for your customers): Their browsing on this site isn't shared with external sites they navigate to. Fail means (for your business): URLs containing session tokens or sensitive parameters can leak to third parties. Fail means (for your customers): Activity on the site may be visible to other websites. Fix: Add Referrer-Policy header via Cloudflare Transform Rules.

Cross-Origin-Opener-Policy

Cross-Origin-Opener-Policy HTTP response header. Informational — whether your site sets COOP. Without it, sites that open yours in a popup keep a reference and can manipulate it. Recommended; not yet scored.

Cross-Origin-Resource-Policy

Cross-Origin-Resource-Policy HTTP response header. Informational — whether your resources can be embedded by arbitrary cross-origin sites. Setting it to same-origin prevents hotlinking and Spectre-class side channels. Not yet scored.

Cross-Origin-Embedder-Policy

Cross-Origin-Embedder-Policy HTTP response header. Informational — required alongside COOP for SharedArrayBuffer and high-resolution timers. Sites that don't need those are unaffected. Not yet scored.

Infrastructure

Three informational checks that describe how your site is hosted: whether it's behind a CDN / WAF, who hosts it, and whether IPv6 is reachable. None of these affect the grade.

3 checks · 3 informational

CDN / WAF Detection

Heuristic detection of common CDN / WAF providers. Informational — whether you sit behind a Content Delivery Network and/or Web Application Firewall. Not scored: CDN/WAF is a strong defensive layer but not strictly required.

Hosting Provider

Reverse-DNS / IP-block heuristic identification. Informational — best-effort identification of who hosts the site. Not scored, but useful context for triage and migration planning.

IPv6 Support

AAAA DNS record presence + reachability. Informational — whether the site has an IPv6 address and is reachable on it. Recommended; not yet scored.

Domain Lifecycle

Three lifecycle checks that depend on RDAP data: domain expiry, registrar transfer-lock, and WHOIS privacy. In v7 we don't gather RDAP, so these always return not-applicable and contribute 0 points. They stay in the registry so the scoring engine recognises them when RDAP comes back online.

3 checks · 3 NA in v7

Domain Expiry

Days remaining until registry expiry (from RDAP). Not applicable in v7 — we don't currently gather RDAP data. When re-enabled, this would warn 90 days before your domain expires (registered value 55 pts).

Registrar Transfer Lock

clientTransferProhibited status (from RDAP). Not applicable in v7 — RDAP not gathered. When re-enabled, this would confirm the transfer-lock that stops attackers from moving your domain to a registrar they control (registered value 45 pts).

WHOIS Privacy

Registrant data redaction (from RDAP). Not applicable in v7 — RDAP not gathered. Where the registry exposes registrant data this would check for privacy redaction (registered 25 pts); where the registry already redacts (.ie, .dk, etc.) it's excluded.

Know what you're missing. Fix it today.

Run your free scan in 30 seconds. No account required. No data stored. Then fix anything that fails with our Domain Fix service.