Zone Intelligence Methodology
How Zone Intelligence grades your domain A–F across 6 security categories. Every check is a live DNS query or HTTP request — no cached data, no simulated results.
How Scoring Works
The overall grade is a weighted average of all 6 category scores. Email Authentication carries the highest weight (25%) because a missing DMARC record is the #1 phishing enabler.
The 6 Security Checks
Each check is a live query performed at scan time. Results are never cached from a previous scan.
Check 1: DNS Integrity
Weight: 20%Framework: NIST 800-53 SC-20, CIS Control 9
- SPF record present and valid
- DKIM record present
- DMARC record with p=reject or p=quarantine
- No dangling DNS records
- No DNS hijacking indicators
- Missing SPF record
- Missing DMARC record (p=none counts as failing)
- Dangling CNAME records
- Subdomain takeover indicators
Check 2: Email Authentication
Weight: 25%Framework: HIPAA § 164.312(e)(2)(ii), CIS Control 9.5
- SPF with -all (hard fail)
- DKIM with 2048-bit key
- DMARC with p=reject and rua/ruf reporting
- No email spoofing possible
- Missing SPF
- SPF with ~all (soft fail)
- Missing DMARC
- DMARC with p=none (monitoring only)
Check 3: SSL/TLS Health
Weight: 20%Framework: NIST 800-52 Rev 2, PCI-DSS 4.0 Req 4
- Valid certificate from trusted CA
- TLS 1.2 or 1.3 only
- HSTS header present
- Strong cipher suites only
- Expired or self-signed certificate
- TLS 1.0 or 1.1 enabled
- Missing HSTS header
- Weak cipher suites (RC4, DES, 3DES)
Check 4: Security Headers
Weight: 20%Framework: OWASP Secure Headers Project, CIS Control 16
- Content-Security-Policy header present
- X-Frame-Options: SAMEORIGIN or DENY
- X-Content-Type-Options: nosniff
- Referrer-Policy header present
- Missing Content-Security-Policy
- Missing X-Frame-Options (clickjacking risk)
- Missing X-Content-Type-Options
- Missing Referrer-Policy
Check 5: Admin Panel Exposure
Weight: 10%Framework: CIS Control 4, NIST 800-53 AC-17
- No WordPress /wp-admin accessible
- No cPanel or Plesk login exposed
- No phpMyAdmin accessible
- Common admin paths return 404 or redirect
- WordPress /wp-admin publicly accessible
- cPanel or Plesk login exposed
- phpMyAdmin accessible without authentication
- Admin panels accessible from public internet
Check 6: AI Visibility
Weight: 5%Framework: llms.txt standard, Schema.org Organization
- llms.txt present at /llms.txt or /.well-known/llms.txt
- Organization JSON-LD structured data on homepage
- robots.txt allows GPTBot and ClaudeBot
- Speakable schema markup present
- No llms.txt found
- No Organization JSON-LD structured data
- robots.txt blocks AI crawlers
- No speakable schema markup
See How Your Domain Scores
Run a free Zone Intelligence scan. Takes under 60 seconds. No account required.