The How and Why of Internet.nl#

Sasha Romijn (Reliably Coded)

• Why: Internet.nl is the compliance-testing tool that effectively sets the practical bar for IPv6, DNSSEC, RPKI, TLS, and mail authentication across the Dutch internet (and beyond) — 1M tests in 2024 on the public site, 8M total. For a network-security-adjacent PM, it's a fascinating case study in turning fuzzy standards into deterministic, defensible test criteria.
• What: A tour of how the test suite decides "good or bad": the normative references (IETF RFC/BCP, CA/Browser Forum, Dutch NCSC, Dutch law on government websites, the Standardisation Forum's comply-or-explain), and the constraint that everything must be testable remotely, quickly, without privileges, without harming the target, and consistently. The deck walks concrete judgment calls — e.g., 3 nameservers where 2 have IPv6 but one is unreachable; NS responding only over TCP; a most-specific route with a ROA while a covering less-specific route has none — and classifies test difficulty: RPKI/DNSSEC/SPF/DMARC easy, HTTPS/headers/DKIM medium, mail TLS genuinely hard (TLS has no way to communicate its config; rate-limited mail servers break tests).
• How: Test areas cover IPv6, DNSSEC (full chain, following CNAME), HTTPS (BCP 195, RFC 8996/9325 informed), HTTP security headers + security.txt, DMARC/DKIM/SPF (with the SPF lookup-limit trap, shown via a real spftrace of internet.nl), STARTTLS+DANE, RPKI, and CAA. Everything is open source, Docker-deployable, with dashboard/API for certain groups; they cross-check against DNSviz, Zonemaster, SSL Labs, RIPE Atlas, and the NLNOG ring.
• Where applicable: Dutch-standards-flavored (some criteria come from Dutch law/policy) but the codebase and methodology are open and self-deployable anywhere. Useful both as a testing tool and as a model for anyone building automated standards-compliance scoring.