Rubric
How the score is calculated
Version 1.0.0. Switch between a plain-English walkthrough and the full technical rubric. The numbers on this page are the same exports the scanner uses, so the page and the code cannot drift apart.
What the scan looks at
We only look at what your domain already shows the public. Nothing hidden, nothing private, and no login. It is like checking whether your shopfront door is locked by looking from the street.
We read your public address-book records (DNS), the settings your website hands to visitors' browsers, and whether your domain is connected to Microsoft 365 or Google Workspace.
Because we stay outside, there is a lot we cannot see: whether staff use a second step to log in, which sign-in rules are in place, whether old insecure logins are still allowed, whether email is being quietly forwarded elsewhere, or whether your backups actually work. Those decide how bad an incident gets, and they need someone inside your system to check. Treat this score as a quick first look, not a full report card.
How the score is worked out
Every domain starts at 100. We only take points off for problems we can prove from the outside. If we cannot be certain, we still show it as a note, but it does not change your score.
Each problem costs points based on how serious it is. No single area, such as email or website security, can take off more than 40 points on its own, so one weak spot cannot sink the whole score.
The score never drops below 0. If we could not check an area at all, we leave it out rather than marking it zero.
How much each problem costs
| Severity | Points off | What it means |
|---|---|---|
| critical | 25 | Broken right now. Treat as urgent. |
| high | 12 | A serious gap. Worth fixing soon. |
| medium | 5 | Worth fixing, but not urgent on its own. |
| low | 2 | A minor hardening improvement. |
| info | 0 | Context only. Never changes the score. |
What the grades mean
| Grade | Score | What it means |
|---|---|---|
| A | 90 and above | Strong. The public-facing basics are in good shape. |
| B | 78 to 89 | Good. A few gaps left to close. |
| C | 62 to 77 | Fair. Fixable issues are starting to add up. |
| D | 45 to 61 | Weak. Several important gaps are open. |
| F | 0 to 44 | Poor. Needs attention across the board. |
Every check, by area
Open an area to see what we look for and what to do about it.
Whether someone can send email that appears to come from this practice.
Sender authentication is incomplete
Publish a single SPF TXT record at the domain apex listing every service that sends mail for the practice, ending in -all. Start with your mail provider, then add your practice management software, booking system and any marketing tool.
12 points if confirmed
Replace ?all with -all once you have confirmed every legitimate sender is listed. A neutral result gives receivers no reason to reject a forged message.
12 points if confirmed
Add -all to the end of the record. Without an all mechanism the record produces a neutral result for every sender it does not list.
12 points if confirmed
Remove the include or redirect that no longer resolves. Void lookups count towards the evaluation limit and usually mean a service was cancelled without cleaning up DNS.
5 points if confirmed
Publish a DMARC record at _dmarc for the domain. Start at p=none with a rua address so you can see who is sending as the practice, then move to p=quarantine and p=reject once the reports are clean.
12 points if confirmed
p=none only reports. Work through the aggregate reports until every legitimate sender passes, then move to p=quarantine and finally p=reject. Until then a forged invoice or referral from this domain reaches the inbox.
12 points if confirmed
The pct tag applies the policy to a sample of messages. Raise it to 100 once reporting is clean, otherwise most forged mail is still delivered.
5 points if confirmed
Add a rua address to the DMARC record. Without aggregate reports there is no way to find out who is sending as the practice, and no safe way to tighten the policy.
5 points if confirmed
Set sp=reject so unused subdomains cannot be used to send mail. Without it subdomains inherit the apex policy, which is usually weaker than it should be.
2 points if confirmed
Sender authentication is failing
SPF allows exactly one record. Receivers treat more than one as a permanent error and stop checking, so mail from this domain is failing authentication right now. Merge every mechanism into one TXT record and delete the others.
25 points if confirmed
Replace +all with -all. As published, the record tells receivers that any server anywhere is allowed to send as this domain, which is worse than having no SPF at all.
25 points if confirmed
RFC 7208 caps SPF evaluation at ten DNS lookups. Past that, receivers return a permanent error and the record stops protecting the domain. Remove services that no longer send mail, and flatten or consolidate the remaining includes.
12 points if confirmed
DKIM signing was observed
No action. This confirms outbound mail is being signed on at least one selector. Confirm inside the tenant that signing covers every sending service.
Context only — no points
DKIM signing was not observed
Confirm DKIM signing inside the tenant. Selectors are chosen by the sending platform and cannot be enumerated from outside, so this check looks at common selectors only and does not prove DKIM is absent.
5 points if confirmed
Mail transport hardening is incomplete
Publish an MTA-STS policy so sending servers require TLS and a valid certificate when delivering to this domain. Without it, an attacker positioned on the network can strip encryption from inbound mail.
2 points if confirmed
Add a TLS-RPT record at _smtp._tls so you receive reports when another server fails to negotiate TLS with your mail servers.
2 points if confirmed
Mail is handled by shared consumer hosting
Mail for a practice that holds health records belongs on a business platform with audit logging, mailbox-level access control and retention. Shared cPanel or ISP mail gives you none of those and no way to investigate an incident.
5 points if confirmed
Whether the domain registration and DNS records are protected against takeover.
DNS integrity protection is not enabled
Enable DNSSEC at the registrar and DNS host. Without it a resolver has no way to detect a forged answer, and the MX and SPF records the whole mail system depends on can be substituted in transit.
5 points if confirmed
Certificate issuance is unrestricted
Publish a CAA record naming the certificate authorities you use. Without one, any public CA may issue a certificate for the domain to whoever passes its validation check.
2 points if confirmed
The domain registration is not locked
Turn on registrar lock in the domain control panel. It is a free setting that blocks a transfer request from moving the domain, which is the fastest route to taking over both the website and the mail.
12 points if confirmed
The domain registration expires soon
Renew the domain and turn on auto-renew. An expired domain takes the website, the mail and every Microsoft 365 sign-in with it, and it can be registered by someone else once it drops.
12 points if confirmed
DNS is hosted on registrar default nameservers
Registrar default DNS usually has no change logging, no role separation and no way to restrict who can edit a record. Move DNS to a provider that logs changes and supports separate accounts.
2 points if confirmed
Whether the website tells browsers to protect the people using it.
The website does not force an encrypted connection
Redirect every HTTP request to HTTPS with a 301. A patient who types the address without https sends the whole request, including anything typed into a booking form, in the clear.
12 points if confirmed
A recommended security header is missing
Send Strict-Transport-Security with a max-age of at least one year. It tells the browser to refuse plain HTTP for this site, which closes the gap the first redirect leaves open.
5 points if confirmed
Add a Content-Security-Policy that lists the sources the site is allowed to load scripts from. It is the control that stops an injected script from running, which is how card and credential skimmers work.
5 points if confirmed
Send X-Content-Type-Options: nosniff so browsers do not guess a content type and execute an upload as script.
2 points if confirmed
Send X-Frame-Options: SAMEORIGIN, or a frame-ancestors directive in the Content-Security-Policy, so the booking page cannot be framed inside a page an attacker controls.
2 points if confirmed
Send Referrer-Policy: strict-origin-when-cross-origin. Without it the full URL of the page a patient was reading is passed to every third party the page loads.
2 points if confirmed
Send a Permissions-Policy that switches off the browser features the site does not use, such as camera, microphone and geolocation.
2 points if confirmed
A security header is set weakly
Raise max-age to at least 31536000 and add includeSubDomains once you have confirmed every subdomain serves HTTPS.
2 points if confirmed
A cookie is set without full protection
Set Secure, HttpOnly and SameSite on every cookie the site sets. A session cookie without these can be read by injected script or sent over plain HTTP.
5 points if confirmed
The server reveals its software version
Suppress the version in the Server and X-Powered-By headers. It saves an attacker the step of working out which published vulnerabilities apply to this host.
2 points if confirmed
What the public DNS records reveal about a Microsoft 365 or Google Workspace tenant.
A Microsoft 365 tenant is in use
No action. This is context for the findings below.
Context only — no points
Sign-in is handled by Microsoft
No action. Confirm inside the tenant that multi-factor authentication and Conditional Access are enforced, which an external scan cannot see.
Context only — no points
Sign-in is federated to another provider
Confirm the federation endpoint is still in use and still patched. A forgotten AD FS server is a route into the tenant that Conditional Access does not cover.
Context only — no points
The sign-in namespace could not be determined
No action from outside. Confirm the domain is verified in the tenant.
Context only — no points
Mail is hosted in Exchange Online
No action. This is context for the mail findings.
Context only — no points
Mail routing suggests a hybrid configuration
Confirm whether the on-premises Exchange server is still needed. A hybrid server kept only for recipient management is still internet-facing and still needs patching.
2 points if confirmed
Mail appears to be delivered on premises
A self-hosted mail server for a practice means you own the patching, the backups and the breach investigation. Confirm it is current and consider moving mail to a hosted platform.
5 points if confirmed
Device registration records are not published
Publish the enterpriseregistration CNAME so domain-joined devices can register with Entra ID. Without it, hybrid join does not complete and device-based Conditional Access has nothing to key on.
5 points if confirmed
Automatic device enrolment is not configured
Publish the enterpriseenrollment CNAME pointing at enterpriseenrollment-s.manage.microsoft.com. Without it a new laptop does not enrol in Intune on its own, so it never receives disk encryption, patch policy or the ability to be wiped remotely. On a device that opens patient records that is the difference between a lost laptop and a notifiable breach.
12 points if confirmed
Records for a retired Microsoft service are still published
Remove the lyncdiscover and sipdir records. Skype for Business Online is retired, so these records point at a service that no longer exists and only serve to confuse a future migration.
2 points if confirmed
A Google Workspace tenant is in use
No action. This is context for the findings below.
Context only — no points
Mail is hosted in Google Workspace
No action. This is context for the mail findings.
Context only — no points
Mail routing suggests a mixed configuration
Confirm whether this is a migration in progress or a deliberate second mail path. An MX set split between Google and another provider usually means one of the two is stale and should be removed.
2 points if confirmed
A Google product is verified for this domain
No action from outside. This TXT record alone does not confirm Google Workspace; it can also come from Search Console, Google Cloud or Google Analytics for a domain hosted anywhere.
Context only — no points
Which third parties receive data about visitors to the site.
Third-party advertising trackers run on the website
An advertising pixel on a page where someone books an appointment or reads about a condition sends that behaviour to a third party for its own purposes. Under the Australian Privacy Principles that is a use and disclosure question you have to be able to answer, and health information is sensitive information. Remove the pixel from clinical and booking pages, or obtain consent that meets APP 6 and say so in the privacy policy.
12 points if confirmed
Session recording runs on the website
Session recording captures what a visitor types and where they hesitate. On a symptom or booking page that is health information leaving the practice to a third party. Exclude clinical and booking pages, or turn the tool off.
12 points if confirmed
A third-party chat widget runs on the website
Patients describe symptoms in chat windows. Confirm where the transcripts are stored, whether they leave Australia, and how long they are kept, and record that in the privacy policy. APP 8 applies if the provider stores data overseas.
5 points if confirmed