Knowledge base

Ten articles on the subjects Digizap's tools were built for: website, email, network and data. Each article ends with the instrument to measure it yourself — free, no account, measurements in your own browser or through our public API.

• Securing a website: the checklist — The four layers that keep a website secured from outside — address, connection, headers and mail — and which measurement proves each item on the checklist.
• SPF, DKIM and DMARC explained — Three DNS texts that together decide whether a message may stand as your domain: what each layer answers, in which order you set them, and what you measure before you close it.
• How to check whether an IP is in your SPF — An IP address posting as your domain: through the include chain, with the lookup limit of RFC 7208 as hard boundary — and the answer a receiver would really give.
• Reading a DMARC aggregate roof — An aggregate roof (RFC 7489) is your mail traffic in XML: reporter, dispositions, authentication combinations and the sources where SPF and DKIM failed together. This article teaches you to read it.
• Security headers: which ones you must set — HSTS, CSP, Referrer-Policy, cookies, X-Content-Type-Options — what each header does, where it belongs, and how to measure what your origin really sets versus what a proxy tinkers.
• TLS 1.0, 1.1, 1.2, 1.3: what is still open? — A server that shows "HTTPS works" can still have three versions open. This article explains what the versions mean and how to have every version and every cipher measured separately.
• Planning CIDR and subnets without collisions — Address space is finite and mathematics forgives no slip: dividing the base network over wishes, without overlaps, with the gaps that remain — on the drawing board, not in the router.
• Cross-checking robots.txt and sitemap — Two documents that may each be fine yet contradict each other together: URLs that robots.txt blocks but the sitemap names anyway. Cross-checking with the measurement that shows it.
• Making and signing security.txt — A security.txt (RFC 8615) is your reporting point before the incident: both paths, the fields that must stand, an expires that is valid, and a PGP signature that really makes the content yours.
• What Google, LinkedIn and WhatsApp take from your page — A link you share becomes a card made from your own head: title, description, og:image and canonical. This article explains what is taken from it and how to measure your own card.