Email Security Score
Run SPF, DKIM, DMARC and blacklist checks at once and get a single 0–100 score with a letter grade for your domain.
How the score is built
The score is a 0 to 100 total from four components, each with a fixed maximum: DMARC 35, DKIM 25, SPF 20 and blacklist status 20. DMARC carries the most weight because it is the control that tells receivers what to do with mail that fails authentication. MTA-STS and BIMI are not part of the number.
The tool runs DMARC first, because the DMARC policy feeds into DKIM scoring (explained below). SPF, DKIM and the blacklist check then run in parallel. If one of the checks errors out, it is scored as a failed check rather than skipped.
Points per component
| Component (max) | Condition | Points |
|---|---|---|
| DMARC (35) | No record | 0 |
| p=none without rua | 6 | |
| p=none with rua | 12 | |
| p=quarantine, pct below 100 | 21 | |
| p=quarantine, pct 100 | 26 | |
| p=reject, pct below 100 | 29 | |
| p=reject, pct 100, no rua | 32 | |
| p=reject, pct 100, with rua | 35 | |
| DKIM (25) | Selector found, 2 or more valid keys | 25 |
| Exactly 1 valid key | 18 | |
| Only test-mode keys (t=y) | 12 | |
| All found keys revoked (empty p=) | 6 | |
| No selector found, DMARC is quarantine or reject | 18 | |
| No selector found, DMARC none or missing | 6 | |
| SPF (20) | No record | 0 |
| Multiple SPF records, missing or ?all, or +all | 4 | |
| More than 10 DNS lookups | 7 | |
| ~all | 11 | |
| -all with 8 or 9 lookups (or 10) | 16 | |
| -all with fewer than 8 lookups | 20 | |
| Blacklist (20) | Critical listing (Spamhaus ZEN or DBL) | 0 |
| High-severity listing (Barracuda, SORBS, SpamCop) | 4 | |
| Medium or low listings only | 10 | |
| No listings | 20 |
Grade bands: A is 90 or above, B is 75 to 89, C is 50 to 74, D is 25 to 49 and F is below 25.
What those numbers imply
- A domain with DMARC at p=none can score at most 77 (20 SPF, 25 DKIM, 12 DMARC, 20 blacklist), which is a B, and at most 71 without a rua address, which is a C. Monitoring mode never reaches an A.
- A p=quarantine domain with everything else perfect scores 91, an A. A p=reject domain with a reporting address can reach 100.
- A Spamhaus listing costs 20 points on its own. A domain that is otherwise perfect drops from 100 to 80, a B.
- The SPF -all versus ~all difference is 9 points. The lookup count only costs points when it reaches 8 or more, which is a warning that you are close to the limit of 10.
- Having two or more DKIM selectors scores higher than one. The reasoning is rotation: a second selector lets you introduce a new key before retiring the old one.
How DKIM detection works and why it can underscore
DKIM keys live at selector._domainkey.yourdomain.com, and the selector name is chosen by whoever configured signing. DNS cannot list selectors, so the tool probes a fixed set of common ones (Google Workspace, Microsoft 365, Amazon SES, SendGrid and others), plus the selectors typical for the mail provider it infers from your MX records. A custom selector will not be found.
To avoid penalizing those domains too harshly, when no selector is detected but DMARC is quarantine or reject, DKIM scores 18 instead of 6. The reasoning is that a domain enforcing DMARC almost certainly signs its mail. That is an inference, not a verification. If your score shows DKIM as undetected, find your selector from the s= tag in the DKIM-Signature header of a sent message, then confirm it with the DKIM checker, which accepts a custom selector.
Improving the score in order of impact
- Publish a DMARC record at _dmarc.yourdomain.com with a rua address. This is worth up to 12 points immediately, and the starting point for everything else.
- Make sure every legitimate sending service passes SPF or DKIM in alignment, using the aggregate reports to find gaps.
- Move DMARC to p=quarantine, then p=reject, at pct=100. Going from none to reject with rua is worth 23 points.
- Switch SPF from ~all to -all once the sender list is confirmed (9 points) and keep lookups below 8 by removing unused include: entries.
- Enable DKIM on every sending platform, and keep a second selector available for rotation.
- Resolve any blacklist listing, starting with Spamhaus.
Make changes one at a time and re-run the score. DNS changes can take time to propagate, depending on the record's TTL.
Common patterns and what they mean
| Pattern | Meaning | Next step |
|---|---|---|
| Score 60 to 75, DMARC p=none | Authentication is in place, but nothing is enforced | Review reports, then quarantine |
| High score, mail still in spam | Authentication passes. The problem is reputation, content or engagement | Check blacklists, complaint rates and content |
| Low score, new domain | Records are simply not published yet | Add SPF, DKIM, then DMARC in that order |
| DKIM 18 with DMARC p=reject | Selector not auto-detected | Confirm your selector in a sent message header |
| SPF 7 | More than 10 lookups, which receivers can treat as an error | Remove includes or restructure the record |
What the score does not measure
- It reads public DNS only. It does not see whether real mail actually passes alignment, which needs DMARC reports or a sent test message.
- It does not measure sender reputation, complaint rates, engagement, content quality or list quality, all of which affect inbox placement.
- It does not include MTA-STS, TLS-RPT, BIMI or DNSSEC. Those are worth having but are separate checkers on this site.
- The weights are this tool's own scoring model. They are not an industry standard, so scores from different tools are not comparable.
Related tools and guides
Frequently Asked Questions
How is the email security score calculated?
The score is a weighted 0–100 calculation based on four checks: DMARC policy enforcement level (highest weight, 35 points), DKIM signing configuration (25), SPF record presence and strength (20), and blacklist status across the DNSBL zones (20). MTA-STS is not part of the score. A domain with full DMARC reject enforcement, valid SPF and DKIM, and a clean blacklist status will score in the 90–100 range.
What is a good email security score?
Scores 80–100 (grade A or B) indicate strong protection — your domain has valid SPF, DKIM, and DMARC enforcement and is not blacklisted. Scores 50–79 (grade C or D) indicate significant gaps, typically DMARC set to p=none or missing DKIM. Scores below 50 (grade F) suggest the domain is vulnerable to spoofing and likely has deliverability issues with major mail providers.
What checks are included in the email security score?
The score runs four checks simultaneously: (1) SPF record validity, DNS lookup count, and enforcement strength; (2) DKIM signing key presence and key strength across 22+ selectors; (3) DMARC policy enforcement level, alignment settings, and reporting configuration; (4) blacklist status across 12 major DNSBL zones. Results are weighted and combined into a single letter-graded score.
Can improving my email security score improve deliverability?
Yes. A higher email security score directly correlates with better inbox placement. Gmail, Microsoft 365, and other major providers use SPF, DKIM, and DMARC authentication as key deliverability signals. Domains without DMARC enforcement or with blacklisted IPs see significantly higher spam filter rates. Moving from p=none to p=reject and fixing SPF errors typically shows measurable deliverability improvement within days.
How often should I check my email security score?
Run a check after any change to your email infrastructure — adding a new platform, switching email providers, or migrating DNS. For actively monitored domains, a monthly manual check is the minimum. DNS records can be accidentally deleted, DKIM keys can expire, and IPs can become blacklisted at any time without visible symptoms until email delivery starts failing.