Background
Path to Internet.nl 100%: how scoring works and how to improve
Internet.nl is an independent Dutch test for modern internet standards on websites and mail. A 100% score means every required category passes the published norm. This guide explains how scoring works, which public adoption figures are worth knowing, and how to improve without guessing.
Test norms and scoring weights can change when Internet.nl releases new versions. Re-run the live test after infrastructure changes. This page is operator guidance, not a certification.
What Internet.nl is testing for
The project checks whether services implement modern standards that improve reliability and security. The norm draws on the Netherlands Standardisation Forum list of open standards for government, NCSC-NL advice, and relevant IETF RFCs. A perfect 100% means required subtests in every scored category passed, not that every optional recommendation is present.
Website test categories (equal weight)
The website test groups required checks into categories such as IPv6 reachability, DNSSEC, HTTPS (TLS and related), security options (headers and related hygiene, including security.txt where required by the current norm), and RPKI for routing authorisation. Because categories weigh evenly, failing one category caps the overall score even if others are green.
Mail test categories (equal weight)
The mail test covers IPv6, DNSSEC, authentication (DMARC, DKIM and SPF), secure mail transport (STARTTLS and DANE), and RPKI. Some standards still matter when no mail servers are configured; Internet.nl documents that nuance on the mail test page. Treat mail and website as separate runs with separate permalinks.
How the percentage is calculated
Per Internet.nl’s report FAQ: each category that contains required subtests contributes the same maximum share of the overall score. Only REQUIRED subtests weigh into a category. Optional advice can appear in the report without moving the percentage. When a new category starts counting (as RPKI did in release 1.9), domains that previously looked perfect can drop until routing authorisation is fixed.
RPKI: why scores changed for many domains
From Internet.nl release 1.9, RPKI is part of the total score. Domains that fail RPKI can no longer claim 100%. Internet.nl reported .nl RPKI usage growing from about 68% in August 2022 to about 88% in January 2025. That is an adoption snapshot for the .nl zone, not a NovaMX product claim. Ask your network operator for Route Origin Authorisation coverage on the prefixes that serve your nameservers, web and mail hosts.
DNSSEC adoption context (verifiable snapshots)
SIDN has reported that around 62% of .nl domain names were DNSSEC-signed in the article cited above, with nearly 60% of inbound DNS traffic coming from validating resolvers, while only about 5% of .com names were signed in the same discussion. High .nl signing rates do not remove the need for a correct chain of trust on your own zone. Broken DS records can look like an outage for validating resolvers.
A practical improvement order
- Run the website test and the mail test separately; save both permalinks.
- Fix DNSSEC and nameserver consistency first; many later checks assume a stable zone.
- Complete HTTPS: valid certificate chain, redirects, HSTS as required by the current norm.
- Publish security headers and security.txt where the report marks them required.
- For mail: SPF within the ten-lookup budget, DKIM on sending streams, DMARC with rua, then STARTTLS/DANE and RPKI on mail hosts.
- Re-test after each change; do not batch unrelated DNS edits into one blind hop.
How NovaMX maps to the path
On NovaMX DNS you can enable DNSSEC with portal-guided DS handling. Hosting and mail products target IPv6 and modern TLS. MailControl covers SPF flattening, DMARC reporting, BIMI and MTA-STS/TLS-RPT hosting so authentication categories become operable. Public baseline: novamx.eu aims for 100% on the Internet.nl website test; re-check after any public change. Customer domains still need their own runs.
Hall of Fame is a separate step
Internet.nl’s Hall of Fame for hosters has its own criteria (including that customers can achieve strong scores). A single 100% on your corporate domain does not auto-list a hoster. See the Hall of Fame FAQ before claiming a badge. NovaMX keeps a draft request pack for operators; only publish a badge after listing is confirmed.
Common false assumptions
- “EU hosting alone gives 100%.” Jurisdiction and rack location are not Internet.nl categories.
- “DMARC p=none is enough forever.” It is a starting policy; many baselines expect a path to enforcement.
- “CDN or mail elsewhere will inherit my apex DNSSEC.” Each name and service in the report must pass on its own records and hosts.
Related NovaMX guides and tools
Use the shorter Internet.nl checklist for click-path steps, the SPF ten-lookup guide when authentication fails on includes, DNSSEC guides for the chain of trust, and the free tools page to inspect SPF and mail auth before you edit DNS.
Common questions
Does 100% mean we are “NIS2 certified”?
No. Internet.nl is a standards test. It is not an NIS2 or ISO certification. Do not market it as one.
Website 100% but mail is lower. Is that normal?
Yes. They are separate tests. Fix mail hosts, DNSSEC on mail-related names, authentication records and transport independently.
How often should we re-test?
After every public DNS, TLS, mail or routing change, and on a regular review cadence (for example monthly) for domains that must stay at 100%.
Where do I start as a NovaMX customer?
Create an account, place DNS or mail services as needed, follow the checklist guide, and use Domains tools in My NovaMX for security checks where available.
Next steps
Run Internet.nl, then follow the checklist and related MailControl guides.