Noiz < Check

A check of how well a website and its email follow current internet standards for security and reliability, run with the open-source Internet.nl test suite.

What the check looks at

The check tests a domain name against current internet standards that make websites and email more secure and more reliable. It reads only what is publicly visible on the internet, so it needs no access to your servers or accounts.

Website test

  • IPv6: whether the web server has an IPv6 address, is reachable over IPv6, and serves the same website over IPv6 and IPv4.
  • DNSSEC: whether the domain name is signed and the signature is valid.
  • HTTPS: whether HTTPS is available and enforced with a redirect and HSTS, and whether the TLS set-up is current: TLS version, cipher suites, key exchange, the certificate and its trust chain, CAA records, and DANE where it is published.
  • Security options: the HTTP security headers X-Frame-Options, X-Content-Type-Options, Content-Security-Policy and Referrer-Policy, and a security.txt file for reporting vulnerabilities.
  • RPKI: whether the web server’s IP addresses are covered by a published route origin authorisation (ROA) and whether their route announcements are valid.

Email test

  • IPv6: whether the mail servers have IPv6 addresses and are reachable over IPv6.
  • DNSSEC: whether the domain and the mail servers’ domains are signed and the signatures are valid.
  • DMARC, DKIM and SPF: whether the domain publishes DMARC and SPF records with a sufficiently strict policy, and whether it supports DKIM. The DKIM key itself cannot be read from outside, because that needs the selector from a sent message.
  • STARTTLS and DANE: whether the mail servers offer STARTTLS with a current TLS set-up and certificate, and whether DANE (TLSA records) is published, valid and has a rollover scheme.
  • RPKI: whether route origin authorisations exist and route announcements are valid for the mail servers and their name servers.

Connection test

Internet.nl also has a connection test, which checks whether your own internet connection reaches IPv6 sites and validates DNSSEC signatures. It runs from your device against your own connection, so it is not part of the report we send. You can run it yourself at internet.nl/test-connection.

Reading the report

Each test gives a percentage score. Every category carries equal weight, and only required items count towards the score; recommended and optional items appear as advice. A full score shows that a domain follows these standards. It does not mean that a website or mail service is fully secure, which is why we add notes on what the results mean for your set-up.

About Internet.nl

Internet.nl is open-source software from the Dutch Internet Standards Platform, a collaboration between the internet community and the Dutch government, published under the Apache License 2.0. Noiz runs the check with this software. Noiz is not affiliated with or endorsed by Internet.nl or the Internet Standards Platform. The source code is at github.com/internetstandards/Internet.nl.

Request a check

Give us a domain name and an email address. We run the website and email tests on the domain and send the report to that address, with notes on anything that needs attention.

The domain name only, without https:// or a path.

We use these details only to run the check and send you the report. See our Privacy Policy.