Guide
Internet.nl 100% checklist
Internet.nl tests your domain for modern web and mail security. novamx.eu scores 100% on the public website test; this checklist helps your domains reach the same strong results on NovaMX hosting.
Website test
- IPv6: AAAA records for web and mail hosts, reachable over IPv6.
- DNSSEC: valid chain from parent DS to signed zone.
- HTTPS: valid Actalis certificate on NovaMX hosting, redirect from HTTP, HSTS on first contact.
- Security options: strict headers and CSP without unsafe inline scripts.
- RPKI: routing origin validation where applicable for your IP ranges.
HTTPS on NovaMX hosting
NovaMX public TLS uses Actalis certificates, not Let's Encrypt or other public CAs. Hosting on NovaMX includes renewal and matching HTTP-to-HTTPS redirects. NovaMX CDN uses TLS 1.2 or newer with modern cipher suites only (no TLS 1.0/1.1 and no outdated ciphers), so Internet.nl HTTPS checks stay aligned when visitors reach your site through the CDN. If you terminate TLS elsewhere, the certificate chain on that endpoint must still be valid for Internet.nl to pass.
Mail test
- SPF: published record without permerror; authorised sending paths covered.
- DKIM: signing enabled for outbound mail with selectors in DNS.
- DMARC: policy record with alignment; start at p=none before enforcement.
- STARTTLS and DANE where NovaMX publishes TLSA for mail hosts.
- MTA-STS and TLS-RPT for transport policy and reporting (MailControl Essential and above can guide publication).
Mail tests and ongoing monitoring
Internet.nl is a snapshot test: useful after DNS or mail changes, but it does not watch your site every minute. Use MailControl in My NovaMX for DMARC sources and transport policy. Use Website monitoring for uptime and response checks. They solve different problems.
Run the tests
Test at Internet.nl after each major DNS or mail change. In My NovaMX, Internet.nl-style domain checks highlight gaps you can fix in the portal when your package includes them.
Suggested order of fixes
Fix mail delivery and authentication first when customers report missing mail: SPF, DKIM, then DMARC at p=none. Then address HTTPS and certificate issues on the website. DNSSEC and transport extras such as MTA-STS matter for score and long-term security, but broken MX or SPF usually hurts sooner than a missing security header.
When you are stuck
Run Internet.nl and note which section fails. Open the domain in My NovaMX and review Internet.nl checks if your package includes them. Browse Help for step-by-step articles, or send a Message with the failing test name and domain.
Own domain versus novamx.eu
novamx.eu already scores 100% on the Internet.nl website test. Your customer domains need the same building blocks on their own DNS and hosts: IPv6, DNSSEC, HTTPS, headers, SPF, DKIM, DMARC and preferably MTA-STS/TLS-RPT. Hosting and mail on NovaMX cover many of these automatically; DNS or TLS elsewhere stays your responsibility to keep aligned.
Common questions
Is Internet.nl a continuous monitor?
No. It is a point-in-time test. Re-run after DNS or mail changes. Use Website monitoring for uptime and MailControl for ongoing DMARC sources.
Do I need Let's Encrypt for 100%?
No. NovaMX public TLS uses Actalis. Internet.nl cares that HTTPS is valid and modern, not which public CA you use, as long as the chain validates.
Website passes but mail fails. What first?
Fix SPF and DKIM, publish DMARC at p=none, then add MTA-STS/TLS-RPT when mail delivery is stable. Use the free mail check on our tools page for a quick view.
Can MailControl help if the site is elsewhere?
Yes for mail authentication tests. Website HTTPS and headers still depend on wherever the site is hosted. See the MailControl standalone guide.