ethz.ch

An authorized sender list is defined and mail from other servers is rejected.

DMARC is in monitoring mode only — forged email still reaches recipients.

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

Mail exchangers are published for the domain.

The site loads over an encrypted connection.

Visitors arriving at an unencrypted address are automatically sent to the secure version.

The certificate was accepted by a validating TLS client at scan time.

Browsers are told to always use an encrypted connection to the site.

A script policy exists, but it's permissive and offers only partial protection.

The site can't be embedded by foreign sites.

The browser won't guess file types in a way that could execute code.

Internal URLs (including parameters) may leak to external sites.

Access to sensitive features like the camera and location isn't restricted.

The server doesn't disclose software versions.

The domain's records are digitally signed and hard to forge.

Only authorized certificate authorities can issue certificates for the domain.

The domain is served by several DNS servers, so one server failing won't take it down.