How the Domain Trust Score is calculated
A number is only useful if you can defend it in a review. This page explains exactly what goes into your Trust Score, so it never becomes a black box.
Coverage and posture are two different things
Most tools blend "how much did we check" and "how secure is it" into one figure, which lets a single weak control hide behind broad coverage. SkyQon keeps them apart. Coverage is the share of your domain estate we have inspected. Posture is how strong the controls are across everything we inspected. The headline Trust Score is derived from both, and we always show you the two inputs.
The modules we weigh
Your posture is assembled from the individual signals inside each trust module, grouped into the areas that move risk:
- Email authentication: SPF, DKIM, DMARC policy and alignment, BIMI, MTA-STS and TLS-RPT.
- DNS & DNSSEC: DNSSEC validation, nameserver health and risky or missing records.
- Certificates & TLS: expiry windows, issuer and chain trust, protocol versions and cipher strength.
- Exposure: subdomain discovery, takeover-prone records, registrar lock and change monitoring.
- Advanced signals: Certificate Transparency, look-alike domains, post-quantum readiness and, where enabled, compliance evidence.
Severity and grades
Each finding carries a severity based on impact: an expiring certificate on a production host outranks a cosmetic misconfiguration. Findings roll up into module scores, module scores into posture, and posture with coverage into an overall score and a plain letter grade, so a non-specialist can read the result at a glance.
We gate the fix, never the finding
Every tier, including the free scan, sees its real findings. What paid tiers add is depth and the exact, copy-paste remediation with one-click re-verification. We will never hide a genuine risk behind a paywall to pressure an upgrade; the finding is always visible, and only the guided fix is a paid feature.
Honest scope
SkyQon measures what is externally observable about your domains. It gives you a strong, continuous signal of your public trust posture. It does not replace a penetration test, and a high score proves good hygiene rather than immunity. We would rather tell you that plainly than oversell a number.
See also: security & trust · what each plan includes · run a free scan.