This page explains how TrustIndex was built: where the businesses come from, how their domains were found and graded, what the DNS scan measures, and how the index is kept current. It is written to be checked — every number below is reproducible from the stated sources.
Baseline: 29 June – 1 July 2026 · DNS re-scanned monthly · methodology version 1.0
Five steps. The first three ran once, to establish the baseline; the DNS scan repeats monthly against the same verified cohort.
The complete Companies Registration Office open dataset — every Irish company on record, including dissolved, liquidated and struck-off entities.
Source: Companies Registration Office open company data, downloaded 29 June 2026.
Companies whose CRO status was Normal at the baseline date were indexed with their address, Eircode and NACE activity code; every other status was excluded. This is the population TrustIndex describes: Irish companies active on the register.
For each company, candidate domains were derived from the registered name and tested — each had to exist in DNS and respond before it was kept. Every company-domain link was graded with a match confidence based on the evidence connecting them (detailed below). A domain can serve more than one registered company — group structures, shared sites — so 90,918 links resolve to 90,559 distinct domains.
Each verified domain was inspected over DNS during the scan window: SPF (presence, default qualifier, lookup count), DKIM (common-selector observation), and DMARC — with the policy parsed from the raw published record, so typos and malformed records are measured as what they are. Every verified domain returned DNS data in the baseline window: zero scan attrition. Domain discovery above was the heavy, one-off step; this DNS scan is light and repeats monthly, tracking the same cohort over time.
Public statistics are built from the 50,222 distinct domains whose company link is high-confidence, aggregated by county, sector and postal town. Cells with fewer than 5 domains are suppressed.
The CRO register has no website field, so the company-to-domain link had to be established and graded. Company-domain matching is probabilistic; to avoid publicly attributing a domain to the wrong company, TrustIndex publishes only the highest-evidence tier.
How candidates were generated. Each registered name was normalised — legal suffixes stripped (Limited, Teoranta, PLC, DAC…), punctuation and filler words removed — and the remaining words joined into a stem. The stem was tried across .ie, .com, .co, .net, .eu, .org, in that order. Candidates with no DNS presence were dropped; survivors were fetched over HTTPS and graded by what came back:
Matching used name-derived candidates verified against the live site. No search engines, WHOIS or certificate data were used — a deliberate, reproducible, if conservative, method. Every match stores its evidence string, so any link can be audited later. All 90,559 domains are scanned each month, but only the high-confidence tier feeds the public statistics. Medium and low matches stay in the research dataset, where they can be upgraded as evidence improves. Where a domain carries different grades through different companies (21 cases), the highest grade is used.
Known misses, by design: companies trading under a different name than they registered, holding companies with no web presence, and sites behind aggressive bot protection (a real site answering 403 grades low). Coverage is deliberately conservative rather than inflated.
TrustIndex publishes statistics — by county, sector and postal town. The underlying domain list is not published, and results are not shown per company. The raw CRO source is public; the derived company-domain mapping is not published because incorrect attribution could harm businesses. Aggregate statistics and the full methodology are published so the national picture can be checked without exposing individual companies.
Cells with fewer than 5 domains are suppressed, to avoid over-interpreting tiny samples. A named controller and a correction route are published; verified requests are actioned and reflected in the next snapshot.
county · sector · town aggregatesno domain listsmall cells suppressedmonthly progressioncorrection routePopularity rankings tell you a domain exists. TrustIndex knows what each domain is — a verified Irish business with a place and an economic activity.
Every company carries a registered county derived from its CRO address — all 26 are covered. This drives the national map and the county league.
NACE is the EU's standard classification of economic activity. Where a company has a recorded NACE code (63% of active companies), it rolls up to one of 21 top-level sections (A–U), so adoption can be compared across the economy.
Where a registered address carries an Eircode (62% of active companies), its routing key — the first three characters — places the business in a postal district.
Presence of the record, the default qualifier at its end (-all / ~all / ?all / +all), and the DNS lookup count. The raw record is stored.
Observation of common selectors only. Absence of a finding means no DKIM found on common selectors — not that DKIM is absent. Confirming DKIM alignment requires a signed test email.
Policy parsed from the raw published record: p, subdomain policy sp, np, testing flag t=y, and legacy pct. Records that do not parse to a valid policy are counted as malformed and non-enforcing.
A domain counts as effectively enforcing only when its effective policy is quarantine or reject — testing mode downgrades a declared policy, and partial pct blocks "strict". Declared and effective postures are reported as different things.
DNS shows published configuration, not whether mail is actually delivered, blocked or accepted by receiving platforms, which may apply their own local policy.
Standards note. DMARC was originally specified in RFC 7489. In 2026 the updated DMARCbis specifications were published as RFC 9989, with reporting separated into RFC 9990 and RFC 9991. TrustIndex parses records against the current standards while recognising that many operational guides still refer to RFC 7489. SPF is RFC 7208; DKIM is RFC 6376.
| CRO records in raw register bulk file, 29 June 2026 | 818,461 |
| Active companies indexed status "Normal"; all other statuses excluded | 329,592 |
| Company→domain links established | 90,918 |
| Distinct domains verified 359 domains serve more than one company | 90,559 |
| Domains DNS-scanned in baseline window zero scan attrition | 90,559 · 100% |
| High-confidence domains → public statistics | 50,222 |
| Medium / low-confidence links retained in research dataset, unpublished | 36,086 / 4,398 |
| Domains with conflicting grades highest grade used | 21 |
| Active companies without a NACE code excluded from the sector lens | 120,991 · 37% |
| Active companies without an Eircode excluded from the town lens | 126,627 · 38% |
| Small-cell suppression threshold | < 5 domains |
Every statistic carries its scan window. The baseline is 29 June – 1 July 2026; each monthly re-scan is a new, dated snapshot.
The same verified cohort is re-scanned monthly, so month-to-month change reflects configuration change — not a shifting cohort. Newly registered companies enter only at a cohort refresh, which is reported separately so dataset growth is never confused with security improvement.
Domains had to exist in DNS and respond before inclusion, and 100% of verified domains returned data in the baseline scan — reachability is a measured property of the dataset.
Only the highest-evidence tier is published; effective enforcement is computed, not taken from declarations; malformed records count as non-enforcing. When in doubt, the number goes down, not up.
Built on Companies Registration Office open data and the IETF email-authentication standards: SPF (RFC 7208), DKIM (RFC 6376) and DMARC (RFC 9989).
A named controller and a correction route; verified requests are actioned and reflected in the next snapshot.
A personal research project by Michal Wochna, extending MSc research into email authentication across Irish domains.