~/home / open data
Open data.
Four datasets this site collects and maintains itself: which domains protect their sender address, which websites send the important security headers, when versions leave support, and what 149 error messages mean. As CSV and JSON, with licence and attribution, no signup.
E-mail security: SPF, DMARC, MTA-STS of 102 domains
Read from public DNS. One row per domain, score 0–100 and grade A–F, plus every individual check.
rows: 102 · columns: 15 · as of: 9 November 2026 · CSV: mail-ranking.csv · JSON: mail-ranking.json
HTTP security headers of 98 websites
From the response headers of the homepage. One row per site, with HSTS, CSP, frame protection, Referrer-Policy, COOP and header leaks.
rows: 98 · columns: 13 · as of: 9 November 2026 · CSV: header-ranking.csv · JSON: header-ranking.json
Version support and end-of-life: 627 versions
Per product and version cycle: release date, latest patch, end of security support, end of life and today's status.
rows: 627 · columns: 10 · as of: 11 November 2026 · CSV: eol-versions.csv · JSON: eol-versions.json
Error codes: 149 messages with cause and fix
SMTP, DNS, TLS, nginx, PHP, databases and Nextcloud. One row per message, with an example and the URLs of all three language versions.
rows: 149 · columns: 10 · as of: 10 November 2026 · CSV: error-lexicon.csv · JSON: error-lexicon.json
Licence and citation
All datasets are CC BY 4.0: use them, including commercially, as long as you credit the source. Suggested citation:
Daniele Michelin, “E-mail security: SPF, DMARC, MTA-STS of 102 domains”, daniele-michelin.com, as of 9 November 2026, CC BY 4.0.
How it is measured
Public queries from the outside only, nothing is sent to the targets. The scripts run weekly and every file carries its own timestamp. A bad grade does not mean a provider is insecure, only that spoofing or header attacks get through more easily.