Legal notice

1. Methodology

ZeroHook Research reads public DNS records through public recursive resolvers and DNSBL zones. It sends no SMTP, HTTP, AXFR or open-resolver probe. Checks: SPF, DMARC, DKIM at 16 common selectors, DNSSEC, MX, NS, CAA, MTA-STS TXT, TLS-RPT TXT, BIMI TXT and DNSBL.

The measurement date is printed in the report. Full protection means a DMARC record with p=reject and pct=100. A p=none or p=quarantine policy is not full protection. DMARC applies to the exact domain in the From header; it does not cover lookalike domains and says nothing about overall security, mail content or other controls.

DKIM means a key found at one of 16 common selectors. That is a lower bound, not a claim that the domain does not use DKIM. A check that could not be measured is excluded from the denominator and is never counted as a pass. Every rate shows n and the not-measured share.

2. Data processing

The published result is aggregate and sector-level. It contains no personal data and no A/AAAA answers, so no IP addresses are published. The raw measurement log stores MX, NS, CAA and TXT record text. The lawful basis is GDPR Art. 6(1)(f) legitimate interests for network and information security, read with Recital 49. The processing relies on a documented legitimate-interest assessment.

Access to raw measurement data is limited to the researcher who maintains the edition. Raw logs are retained for the current edition and for the evidence chain. Aggregate statistics and the evidence manifest are retained for the life of the edition. A deletion request through the contact page removes the domain from future aggregates and from raw logs where no legal obligation requires retention.

Rights: information, access, rectification, erasure, restriction, objection. An objection or opt-out is applied before the next measurement. Contact: the contact page.

3. Notice and right of reply

The published result is aggregate and sector-level. It names no domain, so no domain-level notice is sent for this edition.

If a named result is ever added, a notice would go to a role address or a public security.txt address where one is available. It would contain no product offer and no marketing, and would state what is measured, when, that the result is aggregate, a link to the domain’s own result, a 30-day right of reply, free re-measurement, opt-out and contact.

4. Corrections and removal

Report an error through the contact page. Target: acknowledgement within 2 business days, correction or removal within 5 business days. The lawyer sets the final deadline. Corrections are logged and added to the next evidence manifest.

5. Opt-out

An opt-out removes the domain and its subdomains from future aggregates. Use the contact page. It does not rewrite a published file that already carries a hash and a timestamp.