1 In short
- 4 findings: 4 low.
- The home page does not connect to other domains.
- No known cookie banner was found, so whether 'reject' works was not tested.
0
third parties before consent
–
recognised third parties outside the EU
valid until 2026-12-30
certificate
About this site
- Origin
- unknown no location data; the site does not come from a municipality list
- Page language
- en
- Cookie banner
- No known cookie banner found; accept and reject were not tested.
- Cookies
- 0 before consent, 0 of them third-party
- Data fields
- none
- Certificate
- valid until 2026-12-30 · issuer YR1 · TLS 1.3
2 Security
Can a visitor talk to the site safely: certificate, encryption, forms.
- HSTS
- yes
- Content-Security-Policy
- yes
- X-Content-Type-Options
- yes
- Frame protection
- yes
- Referrer-Policy
- yes
- Software visible
- Vercel
- Unencrypted parts
- 0
- Own cookies
- 0
- External scripts
- 0
2.1 The domain name without www does not work
low low: good to know
What we saw
Anyone typing the address without www gets no site: the bare domain name has no A or AAAA record. Browsers do not add www by themselves. The scan therefore fell back to the www variant.
Why it matters
No risk to data, but lost visitors, and it takes a few minutes in DNS to fix.
What to do
Add an A record (and an AAAA record if the server has IPv6) for the bare domain name, usually called '@' or 'apex', pointing to the same server, and have that server redirect to the www variant. If the site is on a CDN or platform that only offers a CNAME, ask for an ALIAS or ANAME record or use the registrar's forwarding service.
Details: technical risks, when this becomes a problem, laws and standards
Technical risks
- Visitors who copy the address from print, an invoice or a conversation land on an error
- Links placed anywhere without www (social media, business directories, old e-mails) are dead
- Checks that start from the bare domain name (certificate, search engines, this scan) see the site as unreachable
Becomes a problem if
- the address without www appears in e-mail signatures, on print or on the company van
- a client types the address from memory
Laws and standards
3 E-mail
Can anyone send mail in this domain's name, and does mail travel encrypted: SPF, DKIM, DMARC, DANE.
- Mail servers
- mail.protonmail.ch, mailsec.protonmail.ch
- SPF
- ~all
- DMARC
- p=reject
- DKIM found
- protonmail
- SPF lookups
- 5 / 10
- MTA-STS
- no
- TLS-RPT
- no
- DANE
- yes
- STARTTLS
- not measurable from the scanner
3.2 No MTA-STS
low low: good to know
What we saw
MTA-STS lets a domain declare that its mail servers are only reachable encrypted (TLS). Without that policy an attacker between two mail servers can 'switch off' encryption (downgrade) and read the mail.
Why it matters
A DNS record plus a small text file on https://mta-sts.<domain>; DANE is the alternative the government requires.
What to do
Add a TXT record _mta-sts.<domain> (v=STSv1; id=…) and publish https://mta-sts.<domain>/.well-known/mta-sts.txt with mode: enforce and the MX hosts. Add _smtp._tls.<domain> (TLS-RPT) to receive reports.
Details: technical risks, when this becomes a problem, laws and standards
Technical risks
- Mail between companies can be intercepted in transit if the connection is forced to unencrypted
- Without TLS-RPT you never hear that this happens
Becomes a problem if
- the company receives confidential mail (quotes, HR, medical)
- the organisation falls under NIS2 or a sector standard
Laws and standards
Forum Standaardisatie (Dutch Standardisation Forum): STARTTLS and DANE (comply or explain)Applies to: Dutch government and (semi-)public bodies; for companies the yardstick of internet.nl.
4 Domain
Does the domain itself stand firm: DNSSEC, name servers, expiry date, forgotten environments.
- DNSSEC
- yes
- CAA
- no
- Name servers
- 2 (2 networks): ns01.hostnet.nl, ns02.hostnet.nl
- Expires
- not disclosed by the registry
- Registrar
- Hostnet B.V.
4.3 No CAA record
low low: good to know
What we saw
With a CAA record the domain owner states which certificate authorities (Let's Encrypt, Sectigo, …) may issue a certificate for the domain. Without it any authority in the world may do so if someone manages to bypass domain validation.
Why it matters
One DNS record; first check which authority the site and the mail server use.
What to do
Add a CAA record with the authority or authorities you use, for example: 0 issue "letsencrypt.org", and 0 iodef "mailto:admin@domain" for notifications.
Details: technical risks, when this becomes a problem, laws and standards
Technical risks
- A wrongly issued certificate at another authority goes unnoticed
- Without CAA there is no brake on abuse of weak validation elsewhere
Becomes a problem if
- the domain is valuable (brand, customer portal, payments)
- DNSSEC is already in place and this is the last step
Laws and standards
NCSC (Dutch National Cyber Security Centre): ICT security guidelines for web applications (source still to be verified)Applies to: Anyone operating a website or web application; mandatory for central government, the yardstick for everyone else.
5 Privacy
Who the site shares the visitor with, and whether the cookie banner listens to 'no'. No findings within what the scan can see.
6 Sovereignty
Which companies and countries the site depends on.
- Hosting
- Vercel Inc. VS
- CDN
- –
- DNS
- Hostnet B.V. Nederland
- Mail
- Proton AG Zwitserland
- Certificate
- Internet Security Research Group (Let's Encrypt) VS
6.4 The infrastructure depends on a non-EU party
low low: good to know
What we saw
The site, the DNS, the CDN or the mail of this domain runs at a party whose parent company is outside the EU. Where the servers stand does not matter then: legislation such as the US CLOUD Act gives that parent company and its government access.
Why it matters
Moving is work; the first step is knowing where what is, and that is now in this report.
What to do
Choose a European party where possible (hosting, DNS, mail); see the alternatives list. Where that is not possible: record the transfer in the privacy statement and the processing agreement.
Details: technical risks, when this becomes a problem, laws and standards
Technical risks
- Visitor data and mail fall under a foreign jurisdiction
- A sanction, export restriction or policy change at that party hits the site directly
- Transfer outside the EEA must be stated in the privacy statement and arranged contractually
Becomes a problem if
- clients or regulators ask about digital sovereignty
- the organisation falls under NIS2 or a sector standard
- the site processes personal data via forms or mail
Laws and standards
US CLOUD Act (2018) (source still to be verified)Applies to: US companies and their subsidiaries. It reaches you through your suppliers, not directly.
GDPR Chapter V (Article 44 et seq.): transfers of personal data to countries outside the EU (source still to be verified)Applies to: Anyone who shares personal data with a service or company outside the EEA, for example through an analytics or advertising service on the website.
7 Legal information
Does the site say who it is and what the customer may expect: privacy statement, company registration, contact, web shop rules. Only the home page was checked. No findings within what the scan can see.
- Privacy statement linked
- no
- Terms linked
- no
- Contact details
- no
- Company registration number
- no
- VAT number
- no
- Web shop recognised
- no
8 Accessibility
Can everyone use the site, also with a screen reader or poor eyesight: seven checks from WCAG 2.1. No findings within what the scan can see.
- Measured
- no problems on the seven points tested
9 Connections to other domains
A connection means the visitor's browser contacts that domain. It is not proof that personal data is shared. Country is the country of the parent company, not of the server. EU companies first, unknown last.
| Domain and service | Parent company | Country | Before | After accept | After reject |
|---|
| No connections to other domains seen. |
What this scan cannot see
- Only the home page was examined. Forms, login pages and shops on other pages were not measured.
- A connection was counted, not its contents. Whether a service receives personal data has to be checked per service.
- 0 of the 0 third parties are not yet in the vendor database; they do not count towards the EU share.
- Sovereignty is assessed on the jurisdiction of the parent company. Where the servers are and which subcontractors a service uses was not measured.
- Unknown cookie banners are not clicked; consent was therefore not tested.
- No active tests were performed (no login attempts, no hidden paths). Everything here is visible to any visitor.
This report is an indication based on a single passive measurement and does not say whether a site complies with any law. Vendor and alternative descriptions are in Dutch.