Methodology
What we measure, and what we refuse to claim.
The rules below are the whole method. If a result cannot be reproduced from the published files, it does not belong in an edition.
01
Collection
Domains come from public, citable registers. The Hungarian pilot uses Wikidata (query.wikidata.org, CC0) entities with P17=Q28 and an official website (P856), snapshotted on 2026-10-30. Every row keeps its Wikidata QID and the official site URL. Ownership that cannot be checked is dropped, not guessed.
02
Classification
Each entity is placed in one NIS2-aligned sector by an explicit QID map, then by a keyword fallback on its label and description. A state-owned hospital is healthcare, not public administration. Anything that cannot be placed is dropped. The minimum-risk edition keeps only legal-entity companies and excludes public administration and public bodies.
03
Passive scan
The scanner reads public DNS through a local caching resolver: TXT, MX, NS, CAA, DS, DNSKEY, 16 DKIM selectors and three DNSBL zones. It sends no SMTP, HTTP, AXFR or open-resolver probe. MTA-STS is the _mta-sts TXT record only; the HTTPS policy file is not fetched. A token bucket and a single-flight cache stop duplicate queries.
04
Verdicts
A check that could not be measured is marked not measured and excluded from that check’s denominator. It is never a pass. DMARC full protection requires p=reject and pct=100. DNSSEC is a DS-anchored validation of the DNSKEY and answer signatures.
05
Aggregation
Rates are computed per country and sector with their own n. Sectors with fewer than 30 domains are excluded from the sector breakdowns and remain in the overall totals. Every published number is in the JSON file the page imports.
06
Evidence
The domain CSV, the JSONL scan output and the aggregate JSON are hashed with SHA-256 into a manifest. The manifest is timestamped by FreeTSA under RFC 3161. The token and the manifest ship with the report.
What the data cannot say
- A DNS record is not a guarantee of inbox behaviour. A receiver may filter on signals outside DNS, and a p=reject record covers the exact domain, not a lookalike domain.
- DKIM is measured at common selectors only. A key on an unusual selector is missed, so the DKIM share is a lower bound.
- The sample is a register-derived list, not a census. It over-represents domains that have a Wikidata item and an official website.
- No county or city-level cut is published in the pilot because the collector does not record geography. A national number is not a regional one.
- Nothing here is legal advice, a certification, or a statement that a named entity is non-compliant with NIS2.
Measurement date and path
Measurement date: 2026-10-30. Contact: the contact page. Contact.
The required path is a dedicated scanner IP with reverse DNS to zerohook.org/research and an own recursive resolver. This edition was measured on a shared local resolver and no dedicated IP. The path is NOT CONFIGURED, and a dedicated-path re-run is required before publication.
Publication gate
An edition is published as aggregates. A positive Hall of Fame requires written opt-in from the named entity. There is no negative list, no logo wall and no named finding.