Netskor

How Netskor scores

The score follows the model of internet.nl, the test for websites and email by the Dutch Internet Standards Platform. This page lists what counts, what does not yet, and where Netskor does it differently.

What the score is

A report has up to two tests: one for the website and one for email. Each test is made of categories, such as DNSSEC, HTTPS and email authentication.

Only required checks count. Each requirement is worth 10 points, or 2 points for a partial result, as on internet.nl. Recommended and optional checks are advice and never change the score.

A category's score is the share of its points the domain earned. A test is the mean of its categories, and the overall score is the mean of the tests. Every percentage is truncated, so 89.9 becomes 89.

The grade comes from the overall score:

A report has no grade when more than 30% of its categories have no result, for example because their checks could not run. It then shows no score either.

Reports made by scanner versions before 1.0 used an earlier weighted model and keep the score they were stored with.

What each check counts for

Required checks earn the points. The table lists every check the scanner runs, its level, and the internet.nl test it follows. Checks that internet.nl does not have are marked as Netskor only.

CheckLevelFollows on internet.nl
Email
SPF: who may send your email Required SPF record and SPF policy
DMARC: what happens to forged email Required DMARC record and DMARC policy
DKIM: signed email Required DKIM
MTA-STS: encrypted mail delivery Recommended Netskor onlyRecommended while secure mail transport is not scored.
TLS reporting Optional Netskor only
Website
HTTPS Required HTTPS available, and the certificate matches the host name
Redirect from HTTP to HTTPS Required HTTPS forced by a redirect
HSTS: always use HTTPS Required HSTS
HSTS preload list Optional Netskor only
X-XSS-Protection Optional Netskor only
Cross-Origin-Embedder-Policy Optional Netskor only
X-DNS-Prefetch-Control Optional Netskor only
Content Security Policy Recommended Content-Security-Policy
X-Content-Type-Options Recommended X-Content-Type-Options
Protection against framing Optional X-Frame-Options
Referrer-Policy Recommended Referrer-Policy
Exposed software versions Optional Netskor only
Cookie settings Recommended Netskor only
security.txt Recommended security.txt
Certificate expiry Required Certificate trust, for an expired certificate onlyCounts only once the certificate has expired: certificate trust then earns 0 and the overall score is capped at 59.
DNS and domain
DNSSEC Required DNSSEC exists and is valid
CAA: who may issue certificates Recommended CAA records of the web server
Domain registration Required Netskor onlyEarns no points. A failure caps the overall score at 69.

Not scored yet

These are on the list for later. A report shows some of the categories as reserved, and none of this changes the score.

IPv6
The test needs the name, web and mail servers to be reached over IPv6. Netskor has no check for it yet.
RPKI
The test needs the route origin of the servers' addresses to be validated. Netskor has no check for it yet.
Secure mail transport (MTA-STS, DANE, STARTTLS)
The test opens an SMTP connection to port 25 of each mail server. Cloudflare Workers cannot reach port 25. MTA-STS is checked and shown as a recommendation.
TLS parameters
The test looks at protocol versions, ciphers, key exchange, and the certificate key and signature. Netskor does one TLS handshake, so these are not scored.
DNSSEC of the mail domains
The test checks DNSSEC on the domain of each mail server. It needs one query per mail domain and comes later.

Where Netskor differs from internet.nl

Errors are left out
A check that could not run is left out of the score. internet.nl counts it as 0. A scan can fail for reasons that are not the site's fault, such as a bot challenge, so Netskor shows the gap and does not lower the score for it.
Secure mail transport is reserved
internet.nl tests STARTTLS and DANE on every mail server. Cloudflare Workers cannot reach port 25, so Netskor cannot, and the category stays out of the mail test.
Availability caps
A failing HTTPS or an expired certificate caps the overall score at 59. A failed registration check caps it at 69: under 15 days left, or for a .is domain, the fee due date has passed. internet.nl has no such rule. A site that cannot be reached, or a domain that is about to be lost, is in bad shape however well its settings score.
The DMARC cap at B
A mail domain whose effective DMARC policy is not quarantine or reject (t=y with quarantine counts as none) cannot score above 89, which is a B. internet.nl takes only some points off for p=none, so such a domain can still reach an A there. Netskor wants enforced email authentication for an A.
DKIM is stricter
A selector that exists without a key in it fails and earns 0. The same applies when _domainkey holds only an old DomainKeys record, or a wildcard answers without a key. internet.nl passes as soon as the _domainkey name exists.
Dates of .is domains
For a .is domain the date in the registry is ISNIC's annual fee due date. Netskor reads it as that, and the domain fails the check once that date has passed.
DNSSEC on the registrable domain
Netskor checks DNSSEC on the registrable domain, such as example.is. internet.nl checks the host that was tested, such as www.example.is, and follows its CNAMEs.
HTTPS follows internet.nl's strict reading
HSTS earns full points from a max-age of one year, and 2 points below that. The row in the report warns below one year too. The redirect from HTTP must lead to HTTPS on the same host, and a hop to another host, www included, earns 0. Netskor reads HSTS on the last HTTPS response, internet.nl on the first.

Source

Netskor follows internet.nl, release v1.11.6 of its source code, commit ed84717. The requirement levels and the points come from that release.

This methodology is dated 23 October 2026.