How the email security score works

The score is a simple sum of four components, weighted by how much each one contributes to stopping spoofed mail and keeping your own mail deliverable: MX 25, SPF 25, DKIM 20 and DMARC 30 points. Missing records score zero; weak settings score partial points; strict, enforced settings earn full marks plus small bonuses.

Points are computed from public DNS only. A live-email check can add facts DNS cannot show (which selector actually signs, whether outgoing mail is signed at all) but does not change the arithmetic.

What each component looks for

  • MX (25): records exist and resolve; redundancy; a recognised, well-run provider.
  • SPF (25): a single valid v=spf1 record; ends in -all; includes and IP mechanisms are sane; no redirect games.
  • DKIM (20): at least one key found under a common selector; 2048-bit or stronger; more than one selector.
  • DMARC (30): record exists; p=reject scores highest, quarantine less, none least; sp= set; pct=100; rua and ruf addresses present.

Why a score can be capped

A domain can earn full SPF points while still ending in ~all, which does not block anything. To stop a perfect score from meaning "nothing to do", the displayed score is capped at 89 (A-) while a "should fix" item is open and at 69 (C+) while a "fix now" item is open. The raw score is shown next to it. Clear the fix and the cap disappears.

Reaching 100

  • MX records that resolve, from a reputable provider.
  • One SPF record ending in -all with every legitimate sender listed.
  • DKIM enabled at every sending service, signing with your domain, 2048-bit keys.
  • DMARC p=reject (and sp=reject), pct=100, with an rua address you read.

Frequently asked questions

Is a 100 score the same as being un-spoofable?
It means every public record is present and enforced. It cannot see whether every service you use is aligned, which is what DMARC reports and the live-email check are for.
Why did my score drop after I added a service?
Usually because the new service sends unaligned mail (no DKIM with your domain, or its own Return-Path) or because an extra include pushed SPF over the 10-lookup limit.
Are results cached?
Yes, for 15 minutes per domain; use Re-scan after a DNS change. DNS itself can take longer to propagate.

Check your own domain. The scan shows your live records, a score out of 100 and the exact record to publish for each fix.

Related guides

Canonical: https://astraverify.com/email-security-score