You test your domain on internet.nl, expect a tidy report and get a page full of red and orange ticks: 67% or lower. Sound familiar? The good news: virtually every tick can be turned green in a single coordinated sprint, often without you having to write a single line of code yourself. Below is the approach we use with our customers.
What does internet.nl actually measure?
Internet.nl is an initiative of, among others, the Dutch government and tests your domain against modern internet standards in three categories: website (encryption and security headers), mail (authenticity and encryption of email) and connection (IPv6 and DNSSEC). It is not a theoretical quality mark. In practice, a missing SPF or DMARC record means criminals can send mail on behalf of your domain — and that your own quotes end up in spam more often.
Website: modern encryption and secure headers
You arrange this with your hosting provider or in your web server configuration. Enable TLS 1.2 and 1.3 and disable TLS 1.0/1.1. Force a redirect from http to https and then switch on the security headers: HSTS, CSP (Content-Security-Policy), X-Content-Type-Options and X-Frame-Options. On Odoo Online most of this is already set up correctly; if your site runs on your own server or behind a proxy, an extra check is worthwhile.
Mail: SPF, DKIM, DMARC, STARTTLS and DANE
This is where most of the gains are — and most of the risk if you rush it. Add an SPF record at your DNS provider that only allows your known senders (Odoo SMTP, Microsoft 365, Mailgun, etc.). Enable DKIM for each mail provider and publish the key as a TXT record. Set DMARC to p=none first to monitor for four weeks, then raise it to p=quarantine or preferably p=reject. STARTTLS and DANE (a TLSA record) are configured on the mail server itself; with Microsoft 365 and most Dutch mail hosting providers this is now standard or a matter of a support ticket.
Connection: IPv6 and DNSSEC
The fastest gains are often here. Have your hosting provider enable AAAA records (IPv6) and DNSSEC — with most European providers that is literally a tickbox. A logical order for the whole sprint:
- DNSSEC and IPv6 — the biggest quick wins, virtually no risk.
- SPF + DKIM + DMARC — start with
p=none, after four weeks of testing move on toreject. - STARTTLS and DANE on the mail server.
- Web security headers and TLS hardening to finish off.
Blijf hertesten
Tip: don't stop at that one 100% — schedule a retest every quarter. Providers change configurations (a new mail server IP, for example) and your SPF record can quietly break, sending your mail to spam without you noticing. Use free DMARC reports (via Postmark or Dmarcian, for example) to see who is trying to send on behalf of your domain. Need help with that first sprint to 100%? Contact DAADit Group — we have taken this route from red to green many times before.
You test your domain on internet.nl, expect a tidy report and get a page full of red and orange checkmarks: 67% or lower. Recognisable — and there is good news: almost every checkmark can turn green in a single coordinated sprint, often without writing a line of code yourself. Below is the approach we use with our clients.
What does internet.nl actually measure?
Internet.nl is an initiative backed by, among others, the Dutch government. It tests your domain against modern internet standards in three categories: website (encryption and security headers), mail (authenticity and encryption of e-mail) and connection (IPv6 and DNSSEC). It is not a theoretical badge. A missing SPF or DMARC record means, in practice, that criminals can send e-mail on behalf of your domain — and that your own quotations land in spam more often.
Website: modern encryption and secure headers
You arrange this at your host or in your web server configuration. Activate TLS 1.2 and 1.3 and disable TLS 1.0/1.1. Force a redirect from http to https, then enable the security headers: HSTS, CSP (Content-Security-Policy), X-Content-Type-Options and X-Frame-Options. On Odoo Online most of this is already in order; if your site runs on your own server or behind a proxy, an extra check pays off.
Mail: SPF, DKIM, DMARC, STARTTLS and DANE
This is where the biggest gains are — and the biggest risk if you rush it. At your DNS provider, add an SPF record that only allows your known senders (Odoo SMTP, Microsoft 365, Mailgun, etc.). Activate DKIM per mail provider and publish the key as a TXT record. Set DMARC to p=none first and monitor for four weeks, then raise it to p=quarantine or preferably p=reject. STARTTLS and DANE (a TLSA record) are configured on the mail server itself; with Microsoft 365 and most Dutch mail hosts this is now standard or a matter of one support ticket.
Connection: IPv6 and DNSSEC
The quickest wins are often here. Have your host enable AAAA records (IPv6) and DNSSEC — with most European providers this is literally a tickbox. A sensible order for the whole sprint:
- DNSSEC and IPv6 — the biggest quick wins, virtually no risk.
- SPF + DKIM + DMARC — start with
p=none, move torejectafter four weeks of testing. - STARTTLS and DANE on the mail server.
- Web security headers and TLS hardening to finish.
Keep retesting
Tip: don't stop at that one 100% — schedule a retest every quarter. Providers change configurations (a new mail server IP, for example) and your SPF record can silently break, sending your mail to spam without you noticing. Use free DMARC aggregate reports (for example via Postmark or Dmarcian) to see who is trying to send on behalf of your domain. Need help with that first sprint to 100%? Contact DAADit Group — we have taken this journey from red to green more than once.