Perimeter by Cod3Lab

Grades explained

What a Perimeter grade actually means.

Every domain gets one letter from A to F. The letter answers one question: how easy is it for an outsider to find something usable against this domain right now? Below is each grade, what it typically looks like, and what to do next.

The score is a weighted average of the category scores; the letter is read off the score. The example domains below are illustrative, not real customers.

Nothing obvious for an attacker to use.

Score 90–100

From the outside, this domain does what a careful administrator would do: mail cannot be spoofed, certificates are valid and modern, DNS gives nothing away, the website asks the browser to defend itself. Someone probing it from the internet finds no shortcut and moves on.

Typically looks like

  • At most a few low or informational items
  • No CAA record, or HSTS shorter than a year
  • DMARC enforcing, TLS 1.2+ only, certificate months from expiry

What to do

  • Keep it: turn on alerts so a lapse is caught the day it happens
  • Share the public scorecard with clients and insurers
northgate-dental.example
94 / 100 · illustrative
  • Email securityA
  • DNS hygieneB
  • TLS and certificatesA
  • HTTP headersA
Top finding: Low · No CAA record

Good, with loose ends.

Score 80–89

The basics are in place but something is half-done: a DMARC policy that only monitors, a website without a content security policy, DNSSEC switched off. None of it hands an attacker a win on its own, but each one makes the next mistake cheaper to exploit.

Typically looks like

  • One medium finding, or several lows
  • DMARC at p=none, so spoofed mail is reported but still delivered
  • No Content-Security-Policy, DNSSEC disabled

What to do

  • Clear the medium this month; each one is usually a single DNS or header change
  • Expect A after the next scan
harbourview-accounting.example
84 / 100 · illustrative
  • Email securityC
  • DNS hygieneB
  • TLS and certificatesA
  • HTTP headersB
Top finding: Medium · DMARC policy is p=none

Attackers have easy options.

Score 70–79

There is at least one thing a criminal can use today without any skill: most often, mail that can be forged in the company's name because DMARC is missing, which is how invoice fraud starts. A C is not a disaster, but it is the grade at which someone eventually gets a convincing fake email from "the boss". It is also the most common grade for a small business.

Typically looks like

  • One high finding, or a handful of mediums
  • No DMARC record at all, or SPF that allows the whole internet
  • TLS 1.0 or 1.1 still accepted, no HSTS, server version disclosed

What to do

  • Fix the high this week; it is the one finding that moves the grade
  • Open the finding for the exact record or header to change
oakridge-legal.example
71 / 100 · illustrative
  • Email securityD
  • DNS hygieneB
  • TLS and certificatesB
  • HTTP headersC
Top finding: High · No DMARC record published

Weaknesses an attacker finds in minutes.

Score 60–69

Several things are wrong at once, or one of them is serious: an expired certificate that browsers warn about, a name server that hands out the whole DNS zone, a subdomain pointing at a service nobody owns any more. These are the findings automated scanners look for, so assume they have already been found.

Typically looks like

  • One critical finding, or two or more highs
  • Expired certificate, open zone transfer, dangling CNAME ready for takeover
  • No SPF and no DMARC together

What to do

  • Treat it as this week's priority, not a backlog item
  • Fix the critical first, rescan, then work down the list
millbrook-logistics.example
63 / 100 · illustrative
  • Email securityC
  • DNS hygieneF
  • TLS and certificatesD
  • HTTP headersB
Top finding: High · Name server allows zone transfer to anyone

Externally broken.

Score below 60

Serious problems in more than one area at the same time. Mail can be forged, the website shows certificate errors, DNS gives away infrastructure, and nothing asks the browser to protect visitors. An F usually means nobody is looking after the domain, and attackers read it the same way.

Typically looks like

  • Criticals and highs across several categories
  • Expired certificate plus spoofable mail plus a takeover candidate
  • Often a forgotten domain or one left after a migration

What to do

  • Decide first whether the domain is still needed; if not, retire it properly
  • If it is, fix the basics in order: certificate, DMARC, DNS, then headers
old-brand-site.example
38 / 100 · illustrative
  • Email securityF
  • DNS hygieneD
  • TLS and certificatesF
  • HTTP headersF
Top finding: Critical · Certificate expired 41 days ago

How the score is calculated

Each category starts at 100 and loses points per open finding: critical 40, high 25, medium 12, low 5, informational 0. The same problem on extra hosts costs 20% more each, capped at double. The domain score is the weighted mean of the categories that were checked.

Exposed services
20%
Known vulnerabilities
20%
Email security
15%
TLS and certificates
15%
DNS hygiene
10%
HTTP headers
10%
Reputation
5%
Breach exposure
5%

Categories not yet available are left out of the average rather than scored as zero. Findings you mark as accepted risk or false positive are excluded. Grades: A is 90 and above, B 80–89, C 70–79, D 60–69, F below 60.

What a grade is not

  • Not an audit. It describes what the public internet can see, not internal controls, backups or staff training.
  • Not a guarantee. An A can still be breached by a phished password. It means the easy doors are shut.
  • Not a verdict on people. Most C grades are one missing DNS record, often left by a previous provider.
  • Not permanent. A certificate expires, a record is deleted, a grade drops overnight. That is why Perimeter keeps scanning.
See your own grade, freeOne domain, no card.