The security checks every business website and mailbox should pass

Anyone on the internet can test how your website and email domain are set up, and criminals do it automatically. A handful of checks cover most of what they can see: HTTPS done properly, signed DNS records, and proof that mail sent in your name really comes from you. Free, open-source tools such as internet.nl run them in under a minute. This article lists the checks in plain language, explains what each protects, and says what no scanner can tell you.

Why outside checks matter, and what they do not prove

The checks in this article look at your domain from the outside: what a browser, a mail server or an attacker's scanning tool sees when they connect. Weak settings here make it easier to impersonate your business, intercept traffic or forge your email.

They are not the whole picture. internet.nl, the best-known free tester, describes itself as a standards compliance test and "not as a security test". A domain can score 100% and still run a website with an outdated plugin or a mailbox with a reused password. Treat the checks as the locks on the outside of the building.

Your website: the HTTPS basics

1. HTTPS works, with a trusted certificate that matches your domain name.
2. Plain HTTP redirects to HTTPS, so nobody lands on an unencrypted page by accident.
3. HSTS is set. This header tells browsers to use only HTTPS for your site from then on, which stops an attacker quietly downgrading a visitor's connection.
4. Only modern encryption is offered, meaning TLS 1.2 or 1.3, with older, broken settings switched off.

Every Noiz hosting plan includes a free Let's Encrypt certificate; our help article shows how to install one in Plesk.

Your website: the extras that close easy gaps

• Security headers. Short instructions your site sends to browsers: do not show this page inside another site's frame (which stops click-jacking), do not guess file types, and, with a Content-Security-Policy, load scripts only from places you trust.
• A CAA record. A DNS record that names the certificate authorities allowed to issue certificates for your domain, so another authority should refuse a request.
• security.txt. A small text file at a standard address that tells security researchers how to report a problem to you.

Your domain name: DNSSEC

DNS is how the world finds your website and your mail server. DNSSEC adds a digital signature to your domain's DNS answers, so a resolver can tell a genuine answer from a forged one that would send your visitors or your mail somewhere else. Check that DNSSEC is switched on and valid for your domain, and, for email, for the domain of your mail server too.

Your email domain: proving mail is yours

Three DNS records let receiving servers check that mail claiming to be from you is genuine:

• SPF lists the servers allowed to send for your domain. Check there is exactly one SPF record.
• DKIM signs each message. Check that every service that sends as you signs with your domain, ideally with a 2048-bit key.
• DMARC tells receivers what to do with mail that fails, and sends you reports. Aim for a policy of quarantine or reject once you know every legitimate sender passes.

Our help article on protecting your domain from spoofing explains the three in more depth and shows how to set them up.

Your mail server: encrypted delivery

When another mail server delivers to yours, the connection should be encrypted.

• STARTTLS with modern TLS and a valid certificate on your mail server.
• DANE or MTA-STS, which let sending servers insist on encryption instead of falling back to plain text if an attacker interferes. DANE relies on DNSSEC; MTA-STS uses a policy published on a website.
• TLS reporting (TLS-RPT), so other servers can tell you when encrypted delivery to you fails.
• A clean reputation: your sending address not on blocklists, and reverse DNS set.

Your accounts: what no scanner sees

The most common ways into a business never show up in an outside test:

• Two-factor authentication on every mailbox where it is available (Noiz Private Email offers it), on the hosting control panel and on the website's admin accounts. See our guide to two-factor authentication in Plesk.
• Unique passwords, kept in a password manager. Our article on infostealer malware explains why.
• Up-to-date website software: WordPress, themes and plugins.
• Backups you have tested.

Free tools to run today

internet.nl does not test MTA-STS or TLS reporting, so check those records separately if you use them. Two cautions about advice you may find elsewhere. Some testers still ask for "OCSP stapling", but Let's Encrypt, the most widely used free certificate authority, stopped supporting the system behind it in 2025, so there is nothing to fix on a Let's Encrypt certificate. And the UK's NCSC retired its free Mail Check and Web Check services in March 2026.

How Noiz helps

For a domain hosted with Noiz, the Email Security add-on keeps SPF, DKIM and DMARC configured and signs the DNS zone with DNSSEC, which covers several of the email checks above. Every hosting plan includes free Let's Encrypt certificates for HTTPS, and WordPress Care handles the part no scanner sees: weekly updates and security patching for WordPress, themes and plugins. Run internet.nl on your domain today, and if the report shows gaps you would like closed, open a ticket and send us the link to the results.

Sources

Checked 19 October 2026.

Tools

• internet.nl, FAQ: test report
• internet.nl source code
• MDN HTTP Observatory, tests and scoring and source code
• Zonemaster and source code
• NCSC, Retiring Mail Check and Web Check
• Let's Encrypt, Ending OCSP support in 2025
• CISA, BOD 18-01: Enhance email and web security

Standards

• RFC 4033, DNSSEC introduction
• RFC 6797, HTTP Strict Transport Security (HSTS)
• RFC 8659, CAA records
• RFC 9116, security.txt
• RFC 7208, SPF, RFC 6376, DKIM and RFC 9989, DMARC
• RFC 7672, DANE for SMTP, RFC 8461, MTA-STS and RFC 8460, TLS reporting

Noiz

• Email Security add-on
• Shared hosting
• WordPress Care
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.