Version 1.1.0
Scoring methodology
CyberScore is deterministic: the same observations always produce the same score. Each check has published points. Pass earns full points, Warning half, Fail none. Not Tested checks are excluded — never counted as passing.
Category weights
- SPF (Email sender policy)20
- DMARC (Email authentication)25
- HTTPS & transport security25
- Website security headers20
- CAA & DNS hygiene10
Individual checks
| Category | Rule | Points |
|---|---|---|
| SPF | SPF record present, single, syntactically valid, ≤10 lookups; -all passes, ~all warns | 20 |
| DMARC | Policy: p=reject at 100% passes, quarantine or partial warns, none/missing fails | 18 |
| DMARC | Aggregate reporting (rua) configured | 7 |
| HTTPS/TLS | HTTPS reachable with a trusted certificate matching the hostname | 12 |
| HTTPS/TLS | HTTP permanently redirects to HTTPS | 8 |
| HTTPS/TLS | Certificate expiration window | 5 |
| Headers | Strict-Transport-Security (≥180 days passes) | 5 |
| Headers | Content-Security-Policy (permissive directives warn) | 5 |
| Headers | X-Content-Type-Options: nosniff | 3 |
| Headers | Referrer-Policy | 3 |
| Headers | Clickjacking: CSP frame-ancestors or X-Frame-Options | 4 |
| CAA/DNS | CAA record present | 6 |
| CAA/DNS | DNSSEC validated | 4 |
Current scope: checks target the registered (apex) domain. All HTTPS/TLS and header checks are Not Tested in this version because they need an isolated, public-only scanner. SPF inspects the top-level record only (no recursive include evaluation). DKIM is not assessed.
Coverage & bands
Coverage = points of checks actually completed out of 100. Score = earned ÷ tested points × 100. Below 75% coverage we show “Insufficient Data” instead of a score.
- 85–100: Strong observed configuration
- 65–84: Needs attention
- 0–64: Elevated exposure indicators
Scores do not represent breach likelihood, insurance eligibility, or comprehensive security posture.
This is a limited assessment of publicly observable security configuration. It is not a penetration test, complete vulnerability assessment, or guarantee of security.