Having it is not enough. Prove it.

Fix a problem

One page per technical problem: what breaks, the math behind it, the fix step by step, and a free check of your own domain at the end.

• Too many DNS lookups in SPF — Why SPF fails past 10 lookups, how vendor includes add up, and how to get back under the limit. With a free SPF lookup checker.
• CAA record blocks certificate renewal — Which CAA record a CA reads, the four usual causes of a refused renewal, and the fix.
• MTA-STS stuck in testing mode — What to check before you switch to enforce, and the id change that most people forget.
• DNSSEC with SHA-1 algorithms — Why algorithms 5 and 7 no longer protect your zone since RFC 9905, and how to roll over safely.
• 47-day certificates: your renewal workload — The SC-081v3 dates, a renewal calculator, and what to automate first.

NIS2

• NIS2 Article 21(2): what counts as evidence — All ten risk-management measures, what an assessor asks to see for each, and the honest split between what an outside-in monitor can evidence and what stays your own work.

We've also written a page for each measure that leaves a visible trace, each ending in a free check of your own domain:

• 21(2)(d) Supply chain security: check a supplier from outside
• 21(2)(e) Maintenance and vulnerability handling
• 21(2)(f) Showing that your measures work
• 21(2)(g) Basic cyber hygiene
• 21(2)(h) Cryptography and encryption

DORA

• DORA: what counts as technical evidence — The articles that leave externally observable traces (Article 9 and the RTS on encryption, the Article 8 asset register, testing under Articles 24 and 25), plus the Register of Information and concentration duties that reach ICT suppliers through their customers.

Cyber Resilience Act

• The Cyber Resilience Act: your product, not your estate — What the CRA regulates, why Article 14 reporting starts 11 September 2026 and reaches products already on the market, and the honest line between product conformity and anything an outside-in monitor can see.
• Make an SBOM for your stack — The free tool and the command for Python, JavaScript, Java, Go, Rust, .NET, C and C++, containers and Yocto, and four checks before you trust the result.
• The CRA journey for manufacturers — The free scope and class check, the reporting self-check and the 24-Hour Reporting Kit, a fixed-price gap assessment and an implementation sprint, in the order the questions come.

Start somewhere smaller

If you are looking for a definition rather than a walkthrough, the glossary covers each individual trust signal (SPF, DMARC, DNSSEC, CAA, Certificate Transparency, QWAC and the rest), one page per term. The resources pages explain how to read and fix each finding in your own report.

• Domain trust glossary
• Reading and fixing your findings
• How we score a domain