Web Security Scanner

Tidal Control's Web Security Scanner checks a public website through the MDN Observatory, and reads the mail authentication records of the domain the website runs on. It is the simplest integration to set up, because it needs no credentials at all: you give it a hostname, and that one hostname drives all ten tests.

What this integration monitors

Six tests judge the host itself, from a fresh MDN Observatory scan. Apart from the overall score, each one takes the Observatory's own verdict on a single check, and a check the Observatory scores as neither passing nor failing counts as a fail.

• Host should have an MDN Observatory score above B (score > 79): The overall grade, based on all of the host's HTTP security headers and its HTTPS configuration
• Host sends an HSTS header with a max-age of at least six months: Browsers that have seen the header refuse to connect over plain HTTP
• Host redirects HTTP to HTTPS on the same host: A visitor who types http:// ends up on HTTPS
• Host sends a Content Security Policy that allows no unsafe-inline or unsafe-eval scripts: The policy blocks injected inline scripts and eval()
• Host sends X-Content-Type-Options: nosniff: Browsers do not guess a different content type than the server declares
• Host prevents other sites from framing its pages: Clickjacking protection, through X-Frame-Options or a CSP frame-ancestors directive

Four tests judge the mail domain that belongs to the host. That is the registrable domain of the hostname: www.example.com and shop.example.com both give example.com, and www.example.co.uk gives example.co.uk. Hosts on the same domain share one result.

• Mail domain has one SPF record that ends in ~all or -all: Exactly one v=spf1 record, whose closing all is ~all or -all. A redirect= is followed to the record it points at. A record without all or redirect= defaults to ?all and fails, as do +all and ?all
• Mail domain has one DMARC record with a quarantine or reject policy: Exactly one DMARC record at _dmarc.example.com, with p=quarantine or p=reject. p=none fails, because it only reports and blocks nothing
• Mail domain supports DKIM records: The domain publishes DKIM keys under _domainkey.example.com. How the test decides is explained below
• Domain that takes no mail rejects all mail sent in its name: Only applies to a domain without MX records, or with a null MX (MX 0 .). Such a domain must publish an SPF record ending in -all and a DMARC record with p=reject, so nobody can send mail that claims to come from it. A domain that receives mail has nothing to check here, and the test passes

The mail tests read public DNS, so they do not depend on the Observatory reaching your website. An IP address, a host without a public suffix, or a host on a hosting platform's domain such as acme.vercel.app has no mail domain Tidal Control can check, because you cannot publish mail records there.

How the DKIM test decides

DKIM keys sit under selectors, such as selector1._domainkey.example.com, and DNS has no way to list them. The test therefore checks that _domainkey.example.com exists while a random name below it does not. Some DNS setups answer "exists" for every name, through a wildcard record or the compact denial that Azure DNS, Cloudflare and Route 53 use for signed zones. For those, the test only passes when one of the common selectors selector1, selector2, google, k1, s1, s2, default or dkim holds a key.

A domain that authorises no senders at all, with the SPF record v=spf1 -all and a DMARC policy of p=reject, sends no mail to sign. The DKIM test leaves it out.

Requirements

• Super User role in Tidal Control
• A publicly reachable hostname. The Observatory scans from the internet, so an internal-only host cannot be graded

Configuration step-by-step plan

There is nothing to create in another system. You only add the hostname.

Configuration steps:

1. Configure the integration in Tidal Control

Step 1: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to Web Security Scanner
• Fill in the configuration:
  • Name: A descriptive name, for example Website
  • Host name: The bare hostname, for example example.com
• Click "Create" to save the integration

Linking the tests to your controls

Tidal Control's library maps the tests to two controls. HSTS and the HTTP to HTTPS redirect belong to D.08 Encryption of data in transit, and the other eight to C.03 Secure configuration baseline established. A new organisation gets these links through its starter content.

If you connected the scanner before these tests existed, the new tests are not linked to your controls automatically. A test without a control is out of scope, so it does not run every day. To link them:

• Go to Settings → Integrations in Tidal Control
• Open the menu on the Web Security Scanner card and choose Link tests to controls
• The dialog lists each control that gains tests. Click Link to add the links

Linking only adds missing links and never removes one. It skips archived controls and controls that did not come from Tidal Control's library. If every test is already linked, you see "No Web Security Scanner tests to link." You can unlink a test from a control at any time.

Configuration fields explained

The integration dialog asks for the following values:

Name:

• A descriptive name for this connection
• For example: Website, Marketing site

Host name:

• The bare hostname to scan, for example example.com
• Required, and must not start with https
• This is the only field. There is no credential, because the Observatory scans public information. The mail domain follows from this hostname

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows Web Security Scanner under Configured Integrations
• The ten Web Security Scanner tests are available in the Tests section
• The score test shows a grade and score for your host, and links to the full Observatory report
• The mail tests show your mail domain with the SPF and DMARC records they found

Frequently asked questions

Do I need an account or API key for the Observatory? No. The scan uses public information about a public host, so there is nothing to authenticate.

Can I scan more than one site? Yes. Add one connection per hostname, each with its own name.

Can it scan an internal application? No. The Observatory reaches your host from the internet. A host behind a VPN or firewall cannot be graded, so use a manual control for those instead.

How do I improve the grade? Follow the recommendations in the linked Observatory report. The usual wins are adding the standard security headers and enforcing HTTPS.

I configured www.example.com. Why do the mail tests check example.com? Mail addresses use the registrable domain, so that is where the SPF, DMARC and DKIM records belong. Every host under example.com shares the same mail records.

Can I check a different mail domain? The mail domain always follows the hostname. To check another domain, add a connection with a hostname on that domain. Its six website tests then scan that host as well.

Our domain does not send mail. Do we need DKIM? No. Publish v=spf1 -all as the SPF record and a DMARC record with p=reject. The domain then authorises no senders and the DKIM test leaves it out. If the domain also has no MX record, the no-mail test passes as well.

Common problems

"Host must not start with https"

• Remove the scheme. Enter example.com, not https://example.com

"Host is required"

• The field is empty. Enter the hostname to scan

The test reports no score

• The host could not be reached from the internet. Confirm it resolves publicly and serves HTTPS

The mail tests show an error rather than a result

• A DNS lookup timed out or the name server returned an error, so Tidal Control could not read the records. A record that does not exist is a fail. A lookup that gets no answer is an error, so a test never reports a missing DMARC record because a resolver was down. Run the tests again later

The DMARC test fails although you have a DMARC record

• The policy is p=none. That collects reports but lets spoofed mail through. Move to p=quarantine or p=reject once the reports show your own mail passes
• There are two DMARC records at _dmarc. Keep one

The SPF test fails although you have an SPF record

• The record ends in ?all or +all, or has no all at all. End it in ~all or -all
• The domain has two v=spf1 records. Merge them into one

The SPF and DMARC tests fail without listing a domain

• None of your hosts has a mail domain to check, for example because the only host is an IP address or acme.vercel.app. Add a connection with a hostname on your own domain, or unlink these tests from the control

The no-mail test fails on a domain that sends no mail

• The domain has no MX record, but anyone can still send mail that claims to come from it. Publish v=spf1 -all and a DMARC record with p=reject

The DKIM test fails although your mail is signed

• Your DNS answers for every name below _domainkey, and your mail provider uses a selector outside the common list. Send the selector your provider uses to support

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.