Domain Email Health Check
Run a comprehensive email authentication audit across all protocols. Get a weighted security score and actionable recommendations -- entirely from your browser.
What does this score mean?
The Domain Email Health Check runs parallel DNS lookups for every major email authentication protocol and produces a weighted composite score from 0 to 100. Each protocol contributes a fixed number of points based on its relative importance to email security.
The score maps to a grade: A from 90, B from 75, C from 60, D from 40, and F below that. Every protocol that is missing or weak takes points off, and the report names the one fix to make first.
Scoring Methodology
| Protocol | Max Points | What earns full marks |
|---|---|---|
DMARC | 30 |
Exactly one record with p=reject. Quarantine earns
85% of the points, p=none a third, and no record or
several records earn nothing. With t=y the policy is
scored one step down (RFC 9989), so p=reject; t=y
scores as quarantine.
|
SPF | 25 | A record that evaluates without a PermError within the 10-lookup limit. A record that fails to evaluate earns 40%. |
DKIM | 20 | A public key at one of the common selectors we probe. A key published at a selector we do not probe is not found, so use the DKIM checker with your own selector. |
MTA-STS | 12 |
One v=STSv1 TXT record at _mta-sts with
an id.
|
TLS-RPT | 8 |
One v=TLSRPTv1 record at _smtp._tls with
a rua address.
|
BIMI | 5 |
A v=BIMI1 record at default._bimi.
|
DANE | Not scored | Shown beside the score: TLSA records for each MX host, counted only when the TLSA response and the MX records are both DNSSEC-validated. |
DNSSEC | Not scored | Shown beside the score: whether the resolver returns the Authenticated Data (AD) flag. |
Why these weights?
DMARC, SPF and DKIM carry the most weight because they are the foundation of email authentication and directly prevent domain spoofing. MTA-STS and TLS-RPT protect and report on the transport layer, and BIMI is recognition polish. DANE and DNSSEC are shown beside the score but do not change it.
For a deep dive into any individual protocol, use the dedicated checker tools linked from each protocol card in the results.
The same score is one click away on any site you visit with the DMARCguard Chrome extension.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free