Example report, real readings

# A sample external domain check of turva.dev

This is turva.dev's own domain, checked the way a client's domain is checked. The readings are real, and each one carries its own measurement date. A client report has the same six parts. A Finnish client gets it in Finnish, addressed formally.

Report date: 29 October 2026, the day of every reading below. This page was made on the same day.

On these readings there is little to fix. Two optional fixes are listed, both marked low. Findings that belong to the platform or to the email provider are named as theirs and are not handed to the owner as fixes.

[View the check and its scope](/external-domain-check) [Run the public tests yourself](#links)

## Contents

- [Limits](#limits)
- [Agent-readiness](#agent-readiness)
- [Observations](#observations)
- [Fixes](#fixes)
- [Next step](#next-step)
- [Links](#links)

## Limits

The check does not tell you how secure your company is. From outside I cannot see passwords, backups, staff computers or how staff handle phishing. SPF, DKIM and DMARC only show whether someone can send mail in the domain's name.

- Scope: the domain turva.dev, its www form, its email settings and its mta-sts subdomain. Other subdomains were not part of this check.
- My own requests: six GET requests from the published list, of the seven allowed. The spare request was not used. I ran no port scan, no login and no form.
- Cookies: I see only cookies that the home page response sets, not cookies that JavaScript sets.
- The two public tools, isitagentready.com and internet.nl, make their own requests from their own servers. Their scope is their own.
- Platform settings: the server header reads cloudflare, so the TLS and HTTP compression findings appear to be settings of the Cloudflare edge that serves the site.
- Email provider settings: the domain's mail goes to Proton's servers, so the mail server findings describe Proton's servers.
- A missing reading is never counted as a pass, and a missing header or a recommendation is an observation, not a confirmed vulnerability.

## Agent-readiness

I ran the isitagentready.com scanner twice on 2026-10-29, with the default profile, against https://turva.dev. Both runs gave Level 5 of 5, Agent-Native. Every scored check passed in both runs, and the two runs agreed on every check.

The scanner tool returned the level and the result of each check, but no numeric score, so I print none. 23 checks ran, 21 of them scored and 2 informational.

| Category | Result | Checks run |
| --- | --- | --- |
| Discoverability | 4 of 4 passed | robotsTxt, sitemap, linkHeaders, dnsAid |
| Content Accessibility | 1 of 1 passed | markdownNegotiation |
| Bot Access Control | 2 of 2 passed | robotsTxtAiRules, contentSignals |
| API, Auth, MCP & A2A Discovery | 9 of 9 passed | apiCatalog, oauthDiscovery, oauthProtectedResource, authMd, mcpServerCard, a2aAgentCard, agentSkills, webMcp, ard |
| Commerce | 5 of 5 passed | x402, mpp, ucp, acp, ap2 |

Two informational checks are not scored. webBotAuth reported that the Web Bot Auth directory was not found. personalAgentProtocol reported that the Personal Agent Protocol manifest was not found. Neither counts towards the level.

No scored check failed, so the report lists no gap.

## Observations

Every row is an observation. The mark compares the benefit of a fix with the work. It is not an estimate of how secure the company is. Own readings are made by my requests and DNS lookups, and no public test exists for them.

| Measured | Source and date | Reading | What it means | Mark |
| --- | --- | --- | --- | --- |
| Home page | Own reading, 2026-10-29 | https://turva.dev/ answered 200. | The page loads over HTTPS from the bare domain. | low |
| www form | Own reading, 2026-10-29 | https://www.turva.dev/ answered 301 with the Location https://turva.dev/. I did not follow it. | The www address sends visitors to the bare domain. | low |
| robots.txt, sitemap.xml and llms.txt | Own reading, 2026-10-29 | Each answered 200 on turva.dev. | The three files exist at their standard locations. | low |
| MTA-STS policy | Own reading, 2026-10-29 | https://mta-sts.turva.dev/.well-known/mta-sts.txt answered 200: version STSv1, mode enforce, mx mail.protonmail.ch, mx mailsec.protonmail.ch, max_age 604800. | Sending servers that honour MTA-STS are told to require TLS to these two mail hosts, the same two that internet.nl found. | low |
| MTA-STS and TLS-RPT records | Own reading, 2026-10-29 | `_mta-sts.turva.dev` TXT: `v=STSv1; id=20260910202321`. `_smtp._tls.turva.dev` TXT: `v=TLSRPTv1; rua=mailto:info@turva.dev`. | The policy is announced, and reports about failed mail TLS connections go to a role address at the domain. | low |
| CAA records | Own reading, 2026-10-29 | 13 records. `0 iodef "mailto:info@turva.dev"`, and both issue and issuewild for comodoca.com, digicert.com, letsencrypt.org, pki.goog, sectigo.com and ssl.com. | Only these six authorities may issue certificates for the domain, and internet.nl also passed CAA. | low |
| Versions and third parties | Own reading, 2026-10-29 | Header server: cloudflare. No generator meta tag, no third-party script hosts, and no cookies set by the home page response. | No software version number shows in the headers, and the home page loads no script from another host. | low |
| IPv6, DNSSEC and RPKI, website | internet.nl website test, 2026-10-29 20:44 UTC | Passed for the name servers and the web server. | These three settings need no work. | low |
| HTTPS basics | internet.nl website test, 2026-10-29 20:44 UTC | HTTPS available, HTTPS redirect, HSTS, TLS version, cipher suites, cipher suite order and trust chain all passed. | The basics of HTTPS are in place. | low |
| Hash function for key exchange | internet.nl website test, 2026-10-29 20:44 UTC | Failed on two addresses, 104.26.1.140 and 2606:4700:20::ac43:48d4, both among the addresses turva.dev resolves to: SHA1. This is the only failed HTTPS subtest. | The test calls a hash function the server supports for key exchange insufficiently secure, and it appears to be a setting of the Cloudflare edge rather than of the site's own files. | low |
| HTTP compression | internet.nl website test, 2026-10-29 20:44 UTC | Information, not a failure: the web server supports HTTP compression. | The test notes that it could be a security risk, and it appears to be a Cloudflare edge setting. | low |
| Security headers | internet.nl website test, 2026-10-29 20:44 UTC | X-Frame-Options and X-Content-Type-Options passed, and so did Referrer-Policy set to no-referrer. | These headers are in place. | low |
| Content-Security-Policy | internet.nl website test, 2026-10-29 20:44 UTC | Recommendation. style-src contains 'unsafe-inline', and connect-src, img-src and media-src use the bare https: scheme. | The test recommends against 'unsafe-inline', which turva.dev keeps on purpose, and flags the bare scheme, which a small narrowing removes. | low |
| security.txt | internet.nl website test, 2026-10-29 20:44 UTC | Information: the file is in the right location and its syntax is valid. Recommendation: sign it digitally. | Whoever finds a problem can see where to report it, and a signature is a small addition. | low |
| Not testable | internet.nl website test, 2026-10-29 20:44 UTC | OCSP stapling: the certificate has no OCSP pointer. DANE validity: no TLSA record exists. | The test could not read these, and I do not count them as passes. | no reading |
| IPv6 on the mail servers | internet.nl email test, 2026-10-29 20:44 UTC | Failed. mail.protonmail.ch and mailsec.protonmail.ch each have IPv4 addresses and no IPv6 address. IPv6 reachability was not testable. | The two receiving mail servers are Proton's, named by the domain's MX records, so this is a provider setting. | low |
| Mail server certificate key | internet.nl email test, 2026-10-29 20:44 UTC | Recommendation. Both servers use RSA 2048, which the test says should be phased out. | The certificates are Proton's, so this is a provider setting. | low |
| Email authentication and transport | internet.nl email test, 2026-10-29 20:44 UTC | Passed: DNSSEC for the domain and the MX records, and DANE, RPKI and CAA for the mail server. The test calls the SPF policy sufficiently strict. DKIM exists, DMARC exists with a policy and STARTTLS is available. | SPF, DKIM and DMARC show whether someone can send mail in the domain's name, nothing more, and the DANE, RPKI and CAA results are for Proton's mail servers. | low |

internet.nl scored the website test 98 % and the email test 90 % on 2026-10-29. Those are the test's own summary figures. They are not a rating of the company.

## Fixes

There is little to fix on these readings, and I do not add more to fill the list. Two optional fixes follow in the order to make them, both marked low.

- Sign the security.txt file. Ask whoever maintains the site to add a digital signature to it, as internet.nl recommends. Mark: low.
- Narrow the bare https: scheme in the Content-Security-Policy. After checking what the pages load, ask the maintainer to replace it in connect-src, img-src and media-src with the specific hosts that are needed. Mark: low.

The style-src 'unsafe-inline' recommendation is not on the list, because turva.dev keeps it on purpose. Inline styles are used throughout the pages and are not a meaningful route for script injection here, so removing it would cost more work than it returns.

Three more findings are not on the list because they are not the owner's to change. The SHA1 hash for key exchange and HTTP compression appear to be Cloudflare edge settings. The two email findings concern Proton's mail servers. I did not check whether a Cloudflare plan setting can change the SHA1 finding.

## Next step

On these readings no follow-up is needed now.

## Links

- [internet.nl website test result for turva.dev](https://internet.nl/site/turva.dev/4380321/), 2026-10-29 20:44 UTC. Running the test again creates a new result.
- [internet.nl email test result for turva.dev](https://internet.nl/mail/turva.dev/2077240/), 2026-10-29 20:44 UTC.
- [isitagentready.com](https://isitagentready.com/), where anyone can run the scanner on a domain.
- My own readings are marked in the Observations table, and no public test exists for them.