About the census

Who runs it

The census is an independent research project of Webcracy.ch, carried out by Liam Giannini. It has no commercial purpose, and no result can be bought.

For each body the census reads public DNS records, the security.txt file and the homepage. It sends at most one request per second, with no logins and no forms.

Open method

The method and the points are public, so every figure can be checked. No result is changed on request or for payment.

Corrections

Corrections to a domain or a result can be sent to contact@webcracy.ch. They are applied before the next measurement.

Every change of method is recorded in the methodology →

Citation

Cite with the measurement date: the figures change every day. Download the data →

Press and research

Questions about the figures, a canton or a topic can be sent to contact@webcracy.ch. Results for individual bodies are not published.

Seen this in your logs?

This is swiss-security-census. Once a day it checks whether Swiss municipalities, cantons and federal offices use security.txt, SPF, DMARC, DNSSEC, HSTS and TLS 1.2 or newer.

What it requests

DNS: TXT, MX, SOA and DS records, through a public DNSSEC-validating resolver (Quad9). HTTP: GET /.well-known/security.txt and GET / over HTTP and HTTPS, following at most 5 redirects. TLS: one handshake each for TLS 1.0, 1.1, 1.2 and 1.3 on port 443.

At most one request per second per host name. A bounded TCP survey checks each public web or mail IP only once per run. No other paths, forms or logins. HTML is inspected in memory and discarded; only security.txt is stored.