Free check
Check security.txt and e‑mail security
Create a security.txt
Your security.txt
Fill in at least one Contact and an Expires date.
Put the file at https://example.com/.well-known/security.txt, as plain text (text/plain). You can sign it with OpenPGP. Put the expiry date in your calendar: an expired file tells researchers it is out of date.
What security.txt is
security.txt is a small text file in a fixed place on your website: /.well-known/security.txt. It tells whoever finds a vulnerability where to report it. The standard is RFC 9116.
According to the Dutch NCSC only two fields are required: a contact address and an expiry date. The expiry date makes sure nobody keeps trusting a forgotten, outdated file.
Customers and their tools look at things like this. A valid security.txt and well-configured e-mail show that someone keeps the basics up to date.
E-mail security in short
- MX: which servers receive mail for the domain.
- SPF: which servers may send mail for the domain. The policy at the end (for example -all) tells receivers what to do with mail from other servers.
- DMARC: what receivers do with mail that fails the checks: nothing (none), set it aside (quarantine) or refuse it (reject).
- DNSSEC: whether the domain's DNS answers are signed, so they cannot be forged on the way.
Frequently asked questions
- Does about.biz keep what I check?
- No. The result goes only to you and is not stored. To limit abuse we count per day how many checks come from one address, with a code we derive from it that changes every day. We do not keep the address itself.
- Why do I not see everything internet.nl tests?
- We check less than internet.nl, on purpose: only what is also on a passport. For the full test we gladly refer you to internet.nl.
- What if the domain does not answer?
- Then it says “Unavailable”, with the reason. That is different from “none found”: a check that did not run is never shown as clean.