How a check works

Hookgap reads information that every domain publishes so that mail servers and browsers can work. It never logs in, scans ports or tests for vulnerabilities.

What we read

• DMARC: whether the domain tells mail providers to reject fake email (_dmarc TXT record).
• SPF: the list of servers allowed to send its email, including the 10-lookup limit that breaks many setups.
• DKIM: whether signing keys exist on common selectors. Custom selectors cannot be listed publicly, so we never call DKIM "missing".
• Mail provider: Microsoft 365, Google Workspace or another provider, from MX records.
• MTA-STS and TLS reporting: whether email in transit must be encrypted.
• DNSSEC and CAA: signed DNS answers and rules for who may issue certificates.
• HTTPS: whether the site loads securely and redirects plain HTTP.
• Security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame protection and Referrer-Policy.
• Certificate expiry: from public Certificate Transparency logs.
• Domain expiry: from the public registration database (RDAP).
• Exposed versions: software versions advertised in the homepage or response headers.

How the grade works

Each check has a weight based on how much it matters to a small business. Email spoofing protection weighs the most. Anything we could not check is left out of the score instead of counting against the domain. A is 90 or more, B 80, C 65, D 50, and F below 50.

What we send

Requests come from Hookgap's servers with the user agent HookgapBot/1.0. We request the homepage once per check and read at most 100 KB of it. More about the scanner.