Scoring methodology

Every Vernax check returns a score from 0–100. Here you'll learn which individual checks exist, how they're weighted and what the status values mean.

Which checks map to GDPR, ISO 27001, BSI and NIS2 is shown in the standard coverage.

Formula

Score = Σ (weight × multiplier) / Σ weights × 100

Each check has a weight (in percent) and returns a status. The status determines the multiplier:

✓OK

1.0

!Warn

0.5

✗Fail

0.0

iInfo

not weighted

Only the weights of checks that actually ran count — disabled checks or ones missing in context (e.g. CVE lookup for verified domains only) don't drag the score down. Info checks don't count at all – they only provide additional information.

Mail Check

Assesses whether emails from your domain are tamper-proof (SPF, DKIM, DMARC) and delivered encrypted (STARTTLS) — and whether your mail server IPs are on spam blocklists.

Check	Weight	Description
MX record	15 %	Existence and reachability of the mail server
SPF	15 %	Sender Policy Framework – authorized sender IPs
DMARC	15 %	Policy for authentication failures (p=none/quarantine/reject)
DKIM	10 %	Domain Keys Identified Mail – cryptographic signature
STARTTLS	8 %	Encrypted transport to the mail server
TLS version	7 %	At least TLS 1.2, ideally TLS 1.3
Certificate	7 %	Validity of the mail server's TLS certificate
DNSBL	8 %	Check against IP blocklists (spam blacklists)
DBL	5 %	Check against domain blocklists
PTR record	5 %	Reverse DNS – IP points back to the hostname
DNSSEC	3 %	Cryptographic protection of the DNS zone
MTA-STS	1 %	Policy for enforced TLS connections
BIMI	1 %	Brand Indicators for Message Identification – logo in the inbox

SSL Monitor

Checks your website's TLS certificate for validity, hostname and expiry, rates the protocol version and verifies enforced HTTPS redirection.

Check	Weight	Description
Certificate valid	35 %	Certificate present, not expired, hostname matches
Expiry date	30 %	Days until expiry – warn < 30 days, fail if expired
TLS version	20 %	TLS 1.2 = warn, TLS 1.3 = OK, older versions = fail
HSTS	10 %	HTTP Strict Transport Security header present
HTTP redirect	5 %	HTTP requests are redirected to HTTPS

DNS Monitor

Checks the basic configuration of your DNS zone: nameserver redundancy, SOA, CAA records, DNSSEC signing and protection against unauthorized zone transfer (AXFR).

The "All DNS records" check (A, AAAA, MX, TXT, …) is info-only and does not count toward the score.

Check	Weight	Description
DNS snapshot	15 %	Comparison with the previous scan – unexpected changes are flagged
Nameservers	20 %	At least 2 NS records, all reachable and consistent
SOA record	10 %	Start of Authority present and correctly configured
CAA records	15 %	Certification Authority Authorization – which CAs may issue certificates
DNSSEC	20 %	Cryptographic protection of DNS responses
AXFR protection	20 %	Zone transfer from outside not possible (zone-walking protection)

Domain Monitor

Monitors the lifecycle and registry protection of your domain – expiry date, EPP locks, nameserver match, registrar and WHOIS privacy.

Check	Weight	Description
Expiry date	30 %	Days until domain expiry – warn < 30 days, fail if expired
EPP status	20 %	Registry status of the domain (clientDeleteProhibited, serverHold, …)
NS match	20 %	Nameservers in WHOIS and DNS match
Registrar	10 %	Registrar known and reachable
Domain age	10 %	Young domains (< 1 year) are considered riskier
Privacy protection	10 %	WHOIS privacy active – prevents exposure of personal data

CT Monitor

Watches the Certificate Transparency logs for newly issued certificates for your domain – e.g. from unknown CAs or for unexpected subdomains (shadow IT).

Check	Weight	Description
Certificate count	25 %	Unusually many certificates can indicate abuse
Unknown CA	30 %	Certificates from untrusted certificate authorities
Expiring certs	25 %	Certificates expiring in < 30 days
Subdomains	10 %	Unknown subdomains in CT logs – possible shadow IT
Reachability	10 %	Certified hosts are actually reachable

Web Security

Examines your website's HTTP security configuration: HTTPS enforcement, security headers (HSTS, CSP …), exposed server information, open ports and known CVEs.

Check	Weight	Description
HTTPS	25 %	Website reachable only via HTTPS
HSTS	20 %	Strict-Transport-Security header with sufficiently long max-age
Content Security Policy	15 %	CSP header present and not too permissive
Security headers	20 %	X-Frame-Options, X-Content-Type-Options, Referrer-Policy, …
Server info	10 %	No disclosure of server version/technology in headers
Open ports	10 %	No unexpected open ports (e.g. admin interfaces)
Server CVEs	10 %	NVD lookup of the exposed server version (verified domains only)

Reputation Check

Checks the web and mail IPs as well as the domain itself against common spam, phishing and malware blocklists to catch reputation damage to deliverability early.

Blocklists that don't answer our queries (resolver blocking) are reported as info "not checkable" and don't count toward the score.

Check	Weight	Description
Web-IP blacklists	30 %	Domain A/AAAA IPs against Spamhaus ZEN, Barracuda, SpamCop
MX-IP blacklists	25 %	Mail server (MX) IPs against the same blacklists
Domain blocklists	35 %	Domain against Spamhaus DBL and SURBL, with categorization (spam/phishing/malware)
Google Safe Browsing	10 %	Google's threat lists (malware, phishing) – omitted if no API key is configured

Exposure Check

Actively probes for accidentally public, confidential paths – such as .git directories, .env files, database backups or open admin panels (verified domains only).

Only for domains verified in the workspace — the check deliberately requests potentially confidential paths. Unverified domains only get a notice.

Check	Weight	Description
Version control (.git)	30 %	Publicly reachable .git/ directory (HEAD, config) — source code leak incl. history
Environment files (.env)	30 %	.env / .env.production reachable — almost always secrets in plaintext
Backups & databases	25 %	SQL dumps, .zip/.tar.gz archives, SQLite files in the web root
Config & meta files	10 %	.htpasswd, config.php.bak, .DS_Store and similar leaks
Admin panels & listings	5 %	phpMyAdmin, Traefik dashboard, directory listings (warning)

Datenschutz-Check

Statically analyzes the homepage for GDPR-relevant third parties – remotely loaded Google Fonts, trackers, third-country transfers and cookies set before consent.

Static analysis (HTML + linked CSS). Resources loaded via JavaScript and cookies set only through interaction are not captured. Not legal advice.

Check	Weight	Description
Google Fonts	25 %	Loaded remotely from fonts.googleapis.com/gstatic.com — IP transfer to the US (Munich court ruling)
Tracking services	30 %	Google Analytics, Meta Pixel, Hotjar & co. — only permitted after consent
Third-country transfer	20 %	Resources from typical third countries (US CDNs); requires a legal basis (warning)
Cookies before consent	20 %	Cookies set by the server on first visit — only strictly necessary ones allowed (warning)
Consent banner	5 %	Detected CMP (Cookiebot, Usercentrics, Borlabs …) — info, no score penalty

Status values

✓

The check fully passed. Full contribution to the score.

Warn

The configuration is present but could be improved. 50% of the weight.

✗

Fail

The check did not pass. No contribution to the score (multiplier 0).

Info

Purely informational, no scoring impact. Shows e.g. existing DNS records.