Scores & Status

The four statuses

Every sub-check ends with one of four statuses:

Status	Meaning
ok 🟢	Correctly configured — no action needed.
warn 🟡	Works, but not optimal — improvement recommended.
fail 🔴	Missing or misconfigured — should be fixed.
info ⚪	Notice without judgment, e.g. when a check couldn't be performed or is optional.

Why some checks show \"info\" instead of \"fail\"

When Vernax can't perform a check (e.g. because port 25 isn't reachable from the probing server), that is not counted as a fault of your domain — the check appears as \"info\" and does not count negatively toward the score.

The score (0–100)

Every sub-check has a weight matching its security relevance. Example mail: SPF, DMARC and MX weigh considerably more than BIMI or MTA-STS.

• ok counts fully, warn partially, fail not at all.
• info results do not lower the score.
• 100 means: all rated checks are green.

Diagrams in the results

Each result page shows the score composition below the score: a bar that shows how much each sub-check contributes — plus chips like "−10 CSP" that explain at a glance where points are lost.

Additionally per tool:

• SSL & CT — certificate timeline: validity bars on a time axis with a today marker; for CT, all certificates found in the CT logs stacked (yellow = expires in ≤ 30 days).
• Mail — mail flow: the path of an email in two lanes (send authentication SPF → DKIM → DMARC and receipt & transport MX → STARTTLS → certificate), stations colored by check result.
• Web — security header matrix: all six recommended headers as a compact grid (set / missing).
• PDF reports contain a score radar across all tools per domain.

Actions list

In the domain dashboard, the actions button (✓ list) shows a prioritized to-do list across all tools: every warning and error with the score gain that fixing it brings ("+10 set CSP"), sorted by impact. From the Starter plan on, including concrete configuration instructions.

Score badge to embed

Under Settings → Public status page & badge you'll find an embeddable SVG badge with the average score of a domain — e.g. for GitHub READMEs or your own website (green ≥ 80, yellow ≥ 50, red below, updated hourly). The markdown snippet links to your status page.

Change diff in the history

In the check history, the Δ button per entry shows what changed compared to the previous check (status changes, changed values, new or removed items) — additionally, the difference to the previous run is shown next to each score (▲/▼).

Disabling checks

In the workspace you can disable individual sub-checks — globally for the whole workspace or per domain. This is useful when a check deliberately doesn't apply to your setup (e.g. CAA for a mail-only domain).

Disabled checks are removed entirely from the score calculation — they count neither positively nor negatively.

Fix hints

For warn and fail results, the (i) button shows concrete configuration instructions for common servers (Traefik, nginx, Caddy, HAProxy, BIND, …) to fix the issue directly.

Detail views & raw data

Every result page offers several levels of detail:

1. Overview — status and short result per sub-check.
2. Explain mode — step by step what happens technically (DNS resolution, TLS handshake, mail delivery), with the real values of your domain.
3. Details — the full raw data of each check: queried records, certificate fingerprints, cipher, EHLO extensions, DNS digests, computed hashes. You can retrace exactly what Vernax checked and cross-verify with dig/openssl.