What an assessment checks
Assessments observe authorized public DNS, TLS, HTTPS behavior and selected browser security headers. New authorizations also include MX, SPF and direct DMARC publication. Existing mandates keep their original scope. Reports distinguish observations, issues and unassessed controls.
The exact website needs verified domain control, a current representative mandate and enabled assessment access.
- Read the scope and check coverage in the report.
- Start with supported findings that need attention.
- Keep unassessed items separate from verified observations.
Collection covers the exact hostname’s HTTP(S) root and bounded redirects, plus DNS A, AAAA, CAA, CNAME and NS records. The current authorization also includes direct MX and SPF publication at that hostname, and DMARC publication at its direct _dmarc name. Mailbox access, delivery, inherited policies and referenced domains are not tested. The catalogue also includes explicitly unassessed areas: a check count is not a promise of complete coverage.
Understand unknown results
Unassessed, failed and inapplicable checks do not count as successful security checks. The report preserves the limitation and the available evidence.
An external version hint does not confirm an applicable vulnerability. Public registration does not prove MFA enforcement, and a public page cannot prove backups restore.
Public checks cannot establish mailbox delivery, effective SPF/DMARC protection, account MFA, internal patch processes, backup recovery or overall security. No mailbox access, test email, authenticated testing or exploitation is included.