forbes.com

An authorized sender list is defined and mail from other servers is rejected.

Forged email in the company's name is blocked by mail servers.

A DKIM public key is published. On its own this doesn't prove outgoing mail is signed or aligned with your From domain.

Mail exchangers are published for the domain.

The site loads over an encrypted connection.

The site is also reachable over an unencrypted connection, so data may travel in plain text on public networks.

The certificate was accepted by a validating TLS client at scan time.

Browsers are told to always use an encrypted connection to the site.

A script policy exists, but it's permissive and offers only partial protection.

The site can't be embedded by foreign sites.

The browser may interpret files as code unintentionally.

Internal URLs don't leak to external sites.

The site restricts access to sensitive browser features.

The server doesn't disclose software versions.

The domain's records aren't signed, so in some scenarios users could be redirected to a forged server.

Only authorized certificate authorities can issue certificates for the domain.

The domain is served by several DNS servers, so one server failing won't take it down.