Methodology
WebKarne passively measures a domain's public security configuration and turns it into a plain-language report card that needs no technical background. Here is how the measurement works.
Passive measurement only
WebKarne makes only DNS queries and ordinary HTTP GET requests — exactly what a browser or a mail server would do.
No attack, vulnerability scan, directory/file probing, port scan, login attempt or form submission is ever performed. A timeout and a rate limit are mandatory on every request. The measurement is limited to publicly available information that needs no permission from the site owner.
Four dimensions
The report card has four dimensions: Email and domain identity (SPF, DKIM, DMARC, DNSSEC, DANE, MTA-STS and the like); Transport and server security (HTTPS, TLS versions, certificate, HSTS, security headers); Privacy and tracking; Technology and attack surface.
The first two dimensions are measured today. The collectors for privacy and tracking, and for technology and attack surface, are under development; until they are ready these dimensions are shown honestly as not measured.
Measurement and scoring are separate
A collector records exactly what it observed as raw data; it never judges good or bad, and never assigns a score.
Scoring is a completely separate layer that runs on versioned rules. This means the same raw data can be re-scored later even if the rules change. Every dimension grade on the card states which ruleset version produced it.
Four measurement states
Every control is shown in one of four states: passed, failed, could not measure, and not applicable.
Could-not-measure never means no record. If a query fails, it is recorded as could-not-measure without being confused with the record being absent; a domain that does not exist at all (NXDOMAIN) is kept distinct from a query error. This distinction is critical to the accuracy of the measurement.
The grade scale
Letter grades and their thresholds live in a versioned configuration file, separate from the code. Every dimension grade you see on a card comes from that configuration.
This keeps the grade scale transparent and auditable; why a grade was given can be traced all the way back to the raw data and the ruleset version.
Limits and honesty
WebKarne measures only public configuration; it does not access a site's content, user data or private information. Nothing that is not measured is ever guessed or fabricated — if it was not measured, it is shown as such.
This report is a snapshot of public configuration, not a security audit. A good grade does not guarantee a site is secure in every respect; a weak grade rests on concrete, observed gaps.