Skip to content
    Get in touch

    On 15 September 2026, otomoai.com.my scored 100% on the Internet.nl website test: zero fails, zero warnings, zero notices. The full report is public: internet.nl/site/otomoai.com.my/4299470/. This post explains what the test checks, what changed to get there, and where a separate part of the same test (our email) still does not pass.

    What the test checks

    Internet.nl is a free, public, re-runnable test built by the Dutch Internet Standards Platform (Platform Internetstandaarden), a joint effort of the Dutch government and the Dutch internet industry. Anyone can run it against any domain. The website test covers five areas: IPv6, DNSSEC, HTTPS and TLS (including checks that only TLS 1.3-strength cipher suites and key exchanges are offered), security options (the HTTP headers below, plus a security.txt file), and RPKI, a routing security check. A domain that scores 100% qualifies for listing on Internet.nl's Hall of Fame.

    The score, two runs in a row

    Internet.nl website test for otomoai.com.my, 14–15 September 2026.
    DateScoreWhat still failed
    14 September 2026 (first run)95%Cipher suites, cipher suite order, a SHA-1 hash in a key exchange, no CAA record, and a Content-Security-Policy that still allowed 'unsafe-inline' in style-src and a bare https: in img-src
    15 September 2026 (after the CAA, CSP and hosting changes)100%None

    The 95% report is at internet.nl/site/otomoai.com.my/4298297/; the 100% report is at internet.nl/site/otomoai.com.my/4299470/.

    What we changed

    • Added 13 CAA DNS records naming which certificate authorities are allowed to issue a certificate for the domain. Anyone else's certificate request should now be refused.
    • Rewrote the Content-Security-Policy so each page hashes its own inline styles at build time instead of allowing 'unsafe-inline' in style-src, and changed img-src from any https: origin to a named list of hosts.
    • Turned off TLS 1.2, so the server now offers TLS 1.3 only. The site's original hosting setup ignored the minimum TLS version setting, and our hosting provider says so in its own docs. Reaching TLS 1.3-only meant moving the site to a different setup with the same provider. See the provider's Minimum TLS Version docs.
    • Turned on Always Use HTTPS at the edge, so plain http:// now redirects to https://.

    What this does not cover: our email

    The website test and the Internet.nl mail test are separate scores. Our mail test for otomoai.com.my sits at 77%, not 100%. Our mail is hosted on Google Workspace, and the two items still failing (DNSSEC on Google's own MX hostnames, and DANE) are on Google's infrastructure, not ours. SPF, DKIM, DMARC, and DNSSEC on our own otomoai.com.my zone all pass; see our email authentication post for what those four checks do and our current record values.

    What this is not

    • It is not a permanent state. A 100% score is a snapshot on the date of the test. Re-run it yourself at internet.nl/site/otomoai.com.my/ rather than trust the number in this post.
    • It is not a certification. Internet.nl does not certify anything; it reports what it measured against published internet standards, and links the report so anyone can check the same fields.
    • It is not free of trade-offs. TLS 1.3 only means browsers that cannot speak TLS 1.3 (Internet Explorer 11, and the stock browsers of Android 9 or older) cannot open this site at all. Chrome and Firefox on those phones still can, because they ship their own TLS. For a marketing site, we accept that.

    Why a small Malaysian business should care

    These are the same checks a corporate procurement team or an IT reviewer runs before signing off on a vendor. A public, re-runnable report is a faster answer to that review than an explanation would be, and it says exactly which standards were checked rather than asking to be taken on trust.

    Our business website design page lists what a client site includes and what it costs.

    Sources

    Ritchie Boon Win Yew ·