{
    "ok": true,
    "domain": "ky.gov",
    "generated_at": "2026-08-09T00:15:55-05:00",
    "cache": {
        "hit": true,
        "ttl": 0
    },
    "score": {
        "total": 53,
        "label": "Critical",
        "categories": {
            "dns": 85,
            "mail": 90,
            "security": 0,
            "network": 20,
            "availability": 60
        },
        "category_weights": {
            "dns": 25,
            "mail": 20,
            "security": 25,
            "network": 10,
            "availability": 20
        },
        "items": [
            {
                "category": "dns",
                "title": "IPv4 (A)",
                "max_points": 30,
                "earned_points": 30,
                "lost_points": 0,
                "detail": "1 IPv4 address(es) detected."
            },
            {
                "category": "dns",
                "title": "IPv6 (AAAA)",
                "max_points": 10,
                "earned_points": 0,
                "lost_points": 10,
                "detail": "0 IPv6 address(es) detected."
            },
            {
                "category": "dns",
                "title": "Name server redundancy",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0,
                "detail": "3 NS record(s); 2 or more required."
            },
            {
                "category": "dns",
                "title": "SOA record",
                "max_points": 10,
                "earned_points": 10,
                "lost_points": 0,
                "detail": "Authoritative zone record."
            },
            {
                "category": "dns",
                "title": "DNSSEC chain",
                "max_points": 15,
                "earned_points": 15,
                "lost_points": 0,
                "detail": "DS and DNSKEY detected."
            },
            {
                "category": "dns",
                "title": "CAA policy",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5,
                "detail": "Certificate authority restriction."
            },
            {
                "category": "dns",
                "title": "DNS propagation",
                "max_points": 10,
                "earned_points": 10,
                "lost_points": 0,
                "detail": "Agreement between public resolvers."
            },
            {
                "category": "mail",
                "title": "MX records",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0,
                "detail": "2 MX record(s)."
            },
            {
                "category": "mail",
                "title": "SPF",
                "max_points": 25,
                "earned_points": 25,
                "lost_points": 0,
                "detail": "SPF policy published."
            },
            {
                "category": "mail",
                "title": "DMARC",
                "max_points": 25,
                "earned_points": 25,
                "lost_points": 0,
                "detail": "DMARC policy published."
            },
            {
                "category": "mail",
                "title": "DKIM",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0,
                "detail": "A DKIM selector was verified."
            },
            {
                "category": "mail",
                "title": "MTA-STS",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5,
                "detail": "Mail transport policy."
            },
            {
                "category": "mail",
                "title": "TLS-RPT",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5,
                "detail": "TLS reporting policy."
            },
            {
                "category": "security",
                "title": "Valid TLS certificate",
                "max_points": 55,
                "earned_points": 0,
                "lost_points": 55,
                "detail": "No valid certificate was retrieved."
            },
            {
                "category": "security",
                "title": "Certificate lifetime",
                "max_points": 10,
                "earned_points": 0,
                "lost_points": 10,
                "detail": "Full points require at least 30 days remaining."
            },
            {
                "category": "security",
                "title": "HTTP security headers",
                "max_points": 35,
                "earned_points": 0,
                "lost_points": 35,
                "detail": "0 of 9 evaluated headers detected."
            },
            {
                "category": "network",
                "title": "PTR reverse DNS",
                "max_points": 30,
                "earned_points": 0,
                "lost_points": 30,
                "detail": "PTR not detected."
            },
            {
                "category": "network",
                "title": "IPv4 diversity",
                "max_points": 35,
                "earned_points": 20,
                "lost_points": 15,
                "detail": "Two or more IPv4 addresses receive full points."
            },
            {
                "category": "network",
                "title": "IPv6 connectivity",
                "max_points": 35,
                "earned_points": 0,
                "lost_points": 35,
                "detail": "AAAA availability."
            },
            {
                "category": "availability",
                "title": "DNS resolution",
                "max_points": 40,
                "earned_points": 40,
                "lost_points": 0,
                "detail": "At least one address family must resolve."
            },
            {
                "category": "availability",
                "title": "HTTP response",
                "max_points": 40,
                "earned_points": 0,
                "lost_points": 40,
                "detail": "No successful HTTP response."
            },
            {
                "category": "availability",
                "title": "HTTPS final URL",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0,
                "detail": "Final URL uses HTTPS."
            }
        ],
        "methodology": "Each category is normalized to 100. The total is the weighted sum: DNS 25%, Email 20%, Security 25%, Network 10%, Availability 20%.",
        "diagnostics": [
            {
                "level": "ok",
                "title": "IPv4 (A)",
                "detail": "1 IPv4 address(es) detected.",
                "category": "dns",
                "max_points": 30,
                "earned_points": 30,
                "lost_points": 0
            },
            {
                "level": "error",
                "title": "IPv6 (AAAA)",
                "detail": "0 IPv6 address(es) detected.",
                "category": "dns",
                "max_points": 10,
                "earned_points": 0,
                "lost_points": 10
            },
            {
                "level": "ok",
                "title": "Name server redundancy",
                "detail": "3 NS record(s); 2 or more required.",
                "category": "dns",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "SOA record",
                "detail": "Authoritative zone record.",
                "category": "dns",
                "max_points": 10,
                "earned_points": 10,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "DNSSEC chain",
                "detail": "DS and DNSKEY detected.",
                "category": "dns",
                "max_points": 15,
                "earned_points": 15,
                "lost_points": 0
            },
            {
                "level": "error",
                "title": "CAA policy",
                "detail": "Certificate authority restriction.",
                "category": "dns",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5
            },
            {
                "level": "ok",
                "title": "DNS propagation",
                "detail": "Agreement between public resolvers.",
                "category": "dns",
                "max_points": 10,
                "earned_points": 10,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "MX records",
                "detail": "2 MX record(s).",
                "category": "mail",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "SPF",
                "detail": "SPF policy published.",
                "category": "mail",
                "max_points": 25,
                "earned_points": 25,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "DMARC",
                "detail": "DMARC policy published.",
                "category": "mail",
                "max_points": 25,
                "earned_points": 25,
                "lost_points": 0
            },
            {
                "level": "ok",
                "title": "DKIM",
                "detail": "A DKIM selector was verified.",
                "category": "mail",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0
            },
            {
                "level": "error",
                "title": "MTA-STS",
                "detail": "Mail transport policy.",
                "category": "mail",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5
            },
            {
                "level": "error",
                "title": "TLS-RPT",
                "detail": "TLS reporting policy.",
                "category": "mail",
                "max_points": 5,
                "earned_points": 0,
                "lost_points": 5
            },
            {
                "level": "error",
                "title": "Valid TLS certificate",
                "detail": "No valid certificate was retrieved.",
                "category": "security",
                "max_points": 55,
                "earned_points": 0,
                "lost_points": 55
            },
            {
                "level": "error",
                "title": "Certificate lifetime",
                "detail": "Full points require at least 30 days remaining.",
                "category": "security",
                "max_points": 10,
                "earned_points": 0,
                "lost_points": 10
            },
            {
                "level": "error",
                "title": "HTTP security headers",
                "detail": "0 of 9 evaluated headers detected.",
                "category": "security",
                "max_points": 35,
                "earned_points": 0,
                "lost_points": 35
            },
            {
                "level": "error",
                "title": "PTR reverse DNS",
                "detail": "PTR not detected.",
                "category": "network",
                "max_points": 30,
                "earned_points": 0,
                "lost_points": 30
            },
            {
                "level": "warning",
                "title": "IPv4 diversity",
                "detail": "Two or more IPv4 addresses receive full points.",
                "category": "network",
                "max_points": 35,
                "earned_points": 20,
                "lost_points": 15
            },
            {
                "level": "error",
                "title": "IPv6 connectivity",
                "detail": "AAAA availability.",
                "category": "network",
                "max_points": 35,
                "earned_points": 0,
                "lost_points": 35
            },
            {
                "level": "ok",
                "title": "DNS resolution",
                "detail": "At least one address family must resolve.",
                "category": "availability",
                "max_points": 40,
                "earned_points": 40,
                "lost_points": 0
            },
            {
                "level": "error",
                "title": "HTTP response",
                "detail": "No successful HTTP response.",
                "category": "availability",
                "max_points": 40,
                "earned_points": 0,
                "lost_points": 40
            },
            {
                "level": "ok",
                "title": "HTTPS final URL",
                "detail": "Final URL uses HTTPS.",
                "category": "availability",
                "max_points": 20,
                "earned_points": 20,
                "lost_points": 0
            }
        ]
    },
    "dns": {
        "records": {
            "A": [
                "205.204.196.64"
            ],
            "AAAA": [],
            "CNAME": [],
            "MX": [
                "10 mxb-00377201.gslb.pphosted.com.",
                "10 mxa-00377201.gslb.pphosted.com."
            ],
            "TXT": [
                "\"GPJUHe6op5NJmygMkPRfPoehsygmlZHYYFhPoFAkPW2BuBzJKDjoZPtsBr4urnXrc0qqStkKIy4LfrbGVspqIA==\"",
                "\"MS=ms49860986\"",
                "\"MS=ms27744866\"",
                "\"_fr8l06ux9urruvzzduy02hf5l4jkm3u\"",
                "\"_g7eu7wi6z96omt77kzw0jiu5k12xiqt\"",
                "\"iContact1096694\"",
                "\"amazonses:ZDBhsPuqbUfm+if3sDgiuYneE7SgzyrJ5q6tTtwq7BM=\"",
                "\"adobe-idp-site-verification=d317c3ab7a5ba6c446b0aa6bd767b77b065be294ecd9d3ee79cb1247fc6e433f\"",
                "\"wpe-verification=shelbycountyky\"",
                "\"00Dt0000000GzfE=1TBeq000000035y\"",
                "\"v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all\"",
                "\"adobe-idp-site-verification=639c120aaa427472d43170c1c614c2ed96a9548c266e13b3e728c7e15638c6e9\"",
                "\"docusign=80c30a5e-2034-40e4-9e70-852ac3049c2d\"",
                "\"nintex.6344754119468e56596cfc88\"",
                "\"b2l88ogh4s58tbrmalm3oqh55e\"",
                "\"google-site-verification=MbqBk8KCff8Skqt5dsA7cUYts4osTHzu9W6Lqy-K4U8\"",
                "\"_f8swuj1oye658ybwqers0nfkvnrdujf\"",
                "\"google-site-verification=AXFwhgc-5gMI_DhiZvLzPQjqKucdmcbyMot8XDiH8pA\"",
                "\"v=DMARC1; p=none; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1\"",
                "\"include:spf-00377201.pphosted.com -all\"",
                "\"atlassian-domain-verification=/ymFmaQmIRLcauKlLS/4Ba0lb2s8UJ7WY/op6yBSsKDyKjCWMOqEquRHc3HlxFxX\"",
                "\"apple-domain-verification=uxPokH1In2McdW7X\"",
                "\"lpfndzb1z4k8jw0v69krz4pc0qf8d50r\""
            ],
            "NS": [
                "azure.state.ky.us.",
                "midnight.state.ky.us.",
                "ns3.ky.gov."
            ],
            "SOA": [
                "azure.state.ky.us. root.azure.state.ky.us. 2026080518 86400 21600 3600000 600"
            ],
            "CAA": [],
            "DS": [
                "14279 8 2 2FA5400BA466219451126F9E109E23A5710CCB4F55213CAF55BAF95F D97899C3",
                "57445 8 2 36B946211F2865AD75D966EF5A01FA059630A2809C074DD0581070D1 22461D29"
            ],
            "DNSKEY": [
                "257 3 8 AwEAAeCeqW0DtLHFkcdu1G24NysKbfD3eL9NrN3ToatYtGgbyoTT/oXr bjLQ7YvyEf1VdJukTNKqHIru2Sr6Hyz9sHhdAX1gHGQ1C0HzbhXZtGN3 1RQu+YSJQ1cDUBGu2niPOq1Yev4W4SyrzMkd1zeZg523GQfFQVkaZPAk U9RcGpXknAJPqCVokChG9sUnmqEfztKD5d6qV9e9+dqdnRMv1rBIQZJn lB/Gof8+Laug/H6dpq/sUlrA9csEJvZytJwtCAXkWcSYLK1T56GbRuH5 H9Uclnzb9pwRWHhSwKJT296HVE/kfRuG13Ejj4Im/ETgaEYo5YVqjAiw 1k+ZOKgJCx5L8np9QJgyBfNUENiObluHlnVludwAgkalasICUAQxvAtF 96PUTNlGAw/TWLF13s7dQIt08yKNsZKC7CZ0Mp/SOx58MRUNrHCljNtD QoIXoUYwUrV9jan8h+y9ZJuQfALw3+t3Hb4/1j5uMrK/Bgyjh67KH63j weEBzXWOLLCvrw==",
                "256 3 8 AwEAAdOddgdxC0aK5IAqY749h0YCpQBaMWb1zf49SIJc5jp3VB7lxWo8 QgzcwI8wIvdTT1WoS77D/wTxO4qV76iM91gW6qjFGOJNiFcQZgkIRFQ7 F+GsC/eFozeAyZqc8S2XHzuwviP+4VQSfZ5orgNdgoux0m8xVR76SZDA w6T2f55Zz3PTjpYzoS9z7Y1TMkr47D5ffJuyEGBuL9nHajLiOccB70v0 kO8m2EObJ1sn+cia2sKlt6i5vFAsV+E6fawJuw=="
            ],
            "RRSIG": [
                "TXT 8 2 300 20260820145426 20260721135426 29133 ky.gov. jmOS+y2b/1iYufbHol350Ue3VEZiUD5JDcsW5AHJNvBDQf07yAfCB1bU znPxeVDX6oCAXredIo0Ft560Rg/5kYihA4uQaJpga3ir3tT2m3EatmOB VNAeQLeaZ0VMNyHweNay1JiAA3aqMP70BXeVXlUMDxZx33b4p4L4FYh9 pnA/DVGJn+3DGXHdf8s6PR7hukKNbIHzCwHYdSTjcYHg3OuHNRcKX0uf DxtpoeDlTC7nqI3nIR1sYBBwA/tKyl2V",
                "A 8 2 300 20260901141608 20260802131914 29133 ky.gov. po1hxiSKsC0JpGUqLnCBZ5IV+pJO5ugQIKQjgbaToCVGKxd3fL9ClPD0 VZ47zjTX9qWW8pitk0fnHRkzVRYYp6/TJLgGcQJ2cZDHVwt/9mdFAAR3 yjc58WNGwGlCg7jP6my6LvmkDH5Nv3B9iHOCQLEKSCj8jTOZ5B1Cp/Fl cyCLL2xvEVK0FmMZQ6bBL95617Ti+Ikw0WQi9NsqPVCExICMyTuFT6Nf lVf6UBNzOLiFxtqyp7tewYRUH5yJvuZC",
                "DS 13 2 3600 20260810061553 20260808041553 35496 gov. E2Toj32zYBZm/MhI+DsR9SUFGfebgdOBcQS1fs6GkLdzxbk+xuc17pXm +ivjgTNK9yCJbRWDJfPg4aq9FRX9LA==",
                "NS 8 2 86400 20260901141608 20260802131914 29133 ky.gov. KULKZh1WcVHABjEyZdpqd/RqWu8bGumWKRPN6gqXa5CocW7N8HUr48WW +kkueB5jkmV7/lzuY+a4i6EZOIyTC7QboTiQ9edYNQDuGn+zgyGy2HhN vDBSwQgfZBwUwHxkKfvKAwm7ZRVPJNGYlhNWOv+skX8aVmxqSfO4ufMc FeoO64d1XaueQGiKTpOVFpYPizckKBjFACl4hSNDuPQuOeDnFzKAuEpx hYB/XOJCyGISRxJBCpfdnF9g5DJYiHwn",
                "MX 8 2 43200 20260901141608 20260802131914 29133 ky.gov. mXnR04K+MfVfjWJ+mTvNazVQR0wp/GqqD+gaJVsujO9rVuD3nzzqLXJO yZ0hc1CICWVi7g0HWQkh8apKEt71nbp3PHbMYYUiozFBDvJjMLmfzPt3 FwmziDil7OjtRJ3ZsbCs56Z4e1sT2pZbSuDXILwsygdOEOqbhQEbh4YY U0vAQFge/gW4m7Z2RzyY49nS9l3P8pm08wAMlQXIuvdnL4LjyvljuqDD hN3QNnUib15UzJ7yvH1T366EzfdQ+WfY"
            ],
            "NSEC": [
                "26603665.ky.gov. A NS SOA MX TXT RRSIG NSEC DNSKEY TYPE65534"
            ],
            "NSEC3": [],
            "SRV": [],
            "NAPTR": [],
            "TLSA": [],
            "SSHFP": []
        },
        "ipv4": [
            "205.204.196.64"
        ],
        "ipv6": []
    },
    "mail": {
        "spf": "v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all",
        "dmarc": "v=DMARC1; p=none; sp=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;",
        "dkim_selector": "s1",
        "dkim_host": "s1._domainkey.ky.gov",
        "dkim": "k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz8kZ8TAwljyzktHQpdJMd9JGVPqaeKfPQgmqTRwNpIwld02/3kKp4+PiGHVzCKoOkz5S5XdKX6SgaABw20efd+hfKZLGGf0MteToDvUONvkGjiwfsk+8/1NWMd8elMtbqjbtClFvzwHHlBUsIhrg1bwKhv59YDZcws7bmns3XtRfU4XmL4AfAVGXcO0PEk6LuaHe84Jr/eI261mgHkZfPhN4jhq2/uo7kzkALSQdA+9E2lWqUr7/3q3Uk7ovXQ5VnQ03b0+0Bh7rNN3ikBX0mYyP+BzaVpnllmkN4BzHYlHDAIccWjSOHpuQBxgdJ4V/C00I1o9x5XBeaPOXzywJkwIDAQAB",
        "spf_analysis": {
            "valid": true,
            "lookups": 1,
            "final": "~all",
            "message": "Within the estimated limit"
        },
        "dmarc_analysis": {
            "valid": true,
            "policy": "none"
        },
        "bimi": "",
        "mta_sts": "",
        "tls_rpt": ""
    },
    "advanced": {
        "ptr": "",
        "propagation": {
            "consistent": true,
            "results": [
                {
                    "provider": "Google",
                    "server": "8.8.8.8",
                    "result": [
                        "205.204.196.64"
                    ],
                    "time_ms": 73.58
                },
                {
                    "provider": "Cloudflare",
                    "server": "1.1.1.1",
                    "result": [
                        "205.204.196.64"
                    ],
                    "time_ms": 35.13
                },
                {
                    "provider": "Quad9",
                    "server": "9.9.9.9",
                    "result": [
                        "205.204.196.64"
                    ],
                    "time_ms": 47.2
                },
                {
                    "provider": "OpenDNS",
                    "server": "208.67.222.222",
                    "result": [
                        "205.204.196.64"
                    ],
                    "time_ms": 62.26
                },
                {
                    "provider": "AdGuard",
                    "server": "94.140.14.14",
                    "result": [
                        "205.204.196.64"
                    ],
                    "time_ms": 209.08
                }
            ]
        }
    },
    "ssl": {
        "available": false,
        "issuer": "",
        "subject": "",
        "valid_from": "",
        "valid_to": "",
        "days_remaining": null,
        "san": [],
        "protocol": "",
        "cipher": "",
        "error": "Unable to establish an SSL connection"
    },
    "http": {
        "url": "https://ky.gov/",
        "status": "",
        "http_version": "0",
        "headers": [],
        "security_checks": {
            "strict-transport-security": false,
            "content-security-policy": false,
            "x-content-type-options": false,
            "x-frame-options": false,
            "referrer-policy": false,
            "permissions-policy": false,
            "cross-origin-opener-policy": false,
            "cross-origin-embedder-policy": false,
            "cross-origin-resource-policy": false
        },
        "server": "",
        "powered_by": ""
    },
    "webpage": {
        "url": "https://ky.gov/",
        "title": "",
        "description": "",
        "success": false,
        "error": "error:0A000102:SSL routines::unsupported protocol"
    },
    "network": {
        "205.204.196.64": {
            "success": false,
            "country": "",
            "region": "",
            "city": "",
            "asn": "",
            "organization": "",
            "isp": ""
        }
    },
    "smtp": {
        "host": "mxb-00377201.gslb.pphosted.com",
        "ports": [
            {
                "port": 25,
                "open": false,
                "time_ms": 29.4,
                "banner": "",
                "error": "Connection refused"
            },
            {
                "port": 465,
                "open": false,
                "time_ms": 48.4,
                "banner": "",
                "error": "Connection refused"
            },
            {
                "port": 587,
                "open": false,
                "time_ms": 49.7,
                "banner": "",
                "error": "Connection refused"
            }
        ]
    },
    "visitor": {
        "ip": "216.73.217.62",
        "reverse": "",
        "country": "",
        "country_code": "",
        "region": "",
        "city": "",
        "latitude": null,
        "longitude": null,
        "isp": "",
        "organization": "",
        "asn": "",
        "timezone": "",
        "browser": "Other",
        "os": "Other",
        "language": "",
        "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
        "is_bot": true,
        "cloudflare": false
    },
    "analysis_time_ms": 79.64
}