Read a report

Every audit produces a report. The domain’s page shows the latest one; Full report opens it on its own page, and the History card lists the earlier ones.

The domain’s page

At the top, the domain’s status, how often it is audited, the date of the next audit and, when the registry tells us, the date until which the domain is registered and its registrar. The buttons:

• Audit now queues an audit straight away (one an hour on Free and Solo; members, admins and owners can use it).
• Full report opens the report of the latest audit.
• Download PDF gives the report as a PDF, from the Solo plan.

Below come the Score card, with a gauge and the curve of the score over time, and the History of audits (each one says if it was scheduled, on demand, a first audit or a preview). Then:

• Score by family: e-mail, web, DNS, exposure, brand and certificates, and other, each with the score it would have on its own and its open findings, so you see at a glance where the points are lost;
• What changed since the previous audit;
• Simulate: tick the findings you plan to fix and see the score and grade the domain would get (see How the score is computed);
• Do these first, then every finding;
• Open findings and time to fix (proved domains), over the history of your plan: the open findings of each audit by severity, and the mean time to fix by severity, week by week (month by month once there are more than four months of audits).

A finding counts as fixed when it is gone and stays gone at the next audit: one missed audit (a host that did not answer) is not a fix, and an accepted risk is not a fix either. Its time to fix runs from the audit where it appeared, so a finding already there at the start of the period counts as fixed but has no time. It is the same rule as the time to fix of attestations. Each line has its own colour and its own dash; point at the chart, or focus it and use the arrow keys, to read each date, and Show the figures gives the numbers as a table.

The score by family and the simulator are not shown for a quick check run before the proof.

Severities

Each finding has one of five severities, shown by its colour:

Severity	Typical examples
Critical	Something an attacker can use now, such as a record that points to a domain anyone can buy, or a domain that expires within a week.
High	A serious gap, such as a missing DMARC policy, a takeover-prone subdomain or a database port open to the internet.
Medium	A weakness worth fixing soon, such as DNSSEC not enabled or TLS 1.0 still accepted.
Low	Good practice not followed yet, such as no CAA record.
Info	Something worth knowing that is not a problem. It does not count in the score.

The score is computed from these severities.

A finding, part by part

Each finding takes one line (its severity, title and target) until you open it; the first one is open. Click a line to open or close it. Once a finding has the focus (press Tab to reach it, or click it), J and K move to the next or previous finding and O opens or closes it. A link to a finding (from the dashboard or Do these first) opens it directly.

Once open, a finding shows:

• The title and the target: what is wrong, and where (the domain, a host, a mail server, an address).
• The explanation: why it matters, in plain words.
• Fix: what to change. When a DNS record fixes it, a Ready to copy box gives the exact record, built for your domain.
• Evidence: what the audit saw (the record, the header, the answer of the server).
• The finding’s identifier, a link to the related guide, and references.
• Related requirements: the NIS2, Cyber Essentials and ISO 27001 requirements it relates to, as an indication.
• Actions: “Check if it is fixed”, “Accept this finding”, and on the Agency plans “Apply in your DNS” and “Open a ticket”. See Fix a finding.

What changed

When an audit differs from the previous one, the What changed card lists it: new and fixed findings, subdomains that appeared or went away, ports opened or closed, name servers, mail servers, DNSSEC, SPF and DMARC changes, certificates, look-alike domains, cloud storage, and the score moving. The domain list marks such domains with changes. The timeline of changes gathers them for all your domains.

What was observed

At the bottom of the full report, What was observed lists the facts the findings were built from: name servers and DNSSEC, mail servers, the SPF and DMARC records, how many subdomains were found in certificate logs, look-alike domains registered, recent certificates. If a check could not complete (a server that did not answer, for instance), it is named there: the next audit tries again.

Accepted findings

Findings you accepted as a risk stay in the report, in their own Accepted findings section, but they no longer count in the score. See Accept a finding as a risk.

The PDF report

From the Solo plan, Download PDF gives a report you can send: a cover with the site’s logo, its name, address, the date and the score, a summary, then every finding with its fix, the records ready to copy and the compliance mapping. The logo is the site’s own icon by default; upload another one in the domain’s settings. On the Agency plans your own logo appears on every report (“Prepared by”), set in Settings. The PDF is in the language of the workspace.