Scoring, Grades, and Confidence
The top-line score is designed to be useful quickly, but it is not the whole story. Read score and grade alongside risk summary, assessment confidence, coverage notes, and mail-flow interpretation.
What drives the score
The engine weights SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT, and BIMI. Missing or monitoring-only DMARC can cap the score sharply, and missing selector-aware DKIM coverage keeps otherwise strong domains out of top-band results. The current published scoring model version is 11.
What explains the result
Use score_breakdown, risk, assessment_confidence, and coverage_summary to understand why a domain landed where it did and what is still provisional.
Current Grade Bands
| Grade | Score Range | Interpretation |
|---|---|---|
| A+ | 95-100 | Near-perfect visible posture or protected no-mail apex posture with strong evidence. |
| A | 85-94 | Strong visible controls with better coverage and fewer gaps. |
| B | 70-84 | Useful, generally solid posture with meaningful missing coverage or hardening gaps still present. |
| C | 55-69 | Mixed posture with at least one major weakness. |
| D | 40-54 | Material anti-spoofing gaps or weak enforcement. |
| F | 0-39 | Compound failures or clearly unsafe posture. |
Risk
The risk summary explains spoofing risk, deliverability risk, enforcement status, and top actions.
Confidence
High, medium, or low confidence reflects how complete the evidence was for the final assessment.
Mail Flow
Use mail_flow_profile and mail_flow_note before comparing protected no-mail apexes to active sender domains.
Why grades get capped
Most domains do not fail every check — they stall under a ceiling set by one or two specific gaps. These are the caps that limit scores most often, starting with the sharpest:
DMARC missing or monitoring-only
Without an enforcement policy, spoofed mail can still pass — this caps the score sharply. Moving from p=none to quarantine or reject is the single biggest grade move for most domains. Why p=none is still a risk
DKIM coverage gaps
Missing selector-aware DKIM coverage keeps otherwise strong domains out of the top band. Selectors rotate and providers publish several — auditing only the default selector misses the real signing footprint. How DKIM discovery works · What is a DKIM selector
SPF lookup-limit risk
SPF evaluations that exceed 10 DNS lookups fail permanently (permerror), and include chains from third-party senders are the usual cause. Flattening trades one fragility for another. SPF lookup-limit guide
Transport hardening missing
A domain can score well on authentication and still lack MTA-STS and TLS-RPT, leaving inbound TLS unprotected and unreported. These weigh less than DMARC and DKIM, but they are what separates an A from an A+.
No-mail apexes vs sender domains
A protected no-mail apex (SPF -all, p=reject, no MX) can grade A+ while an active sender with the same records grades lower — the mail-flow profile is different. Check mail_flow_profile before comparing two domains.
Low assessment confidence
When DNS evidence is incomplete — timeouts, truncated responses, or selectors that could not be enumerated — confidence drops and the score stays conservative. Re-run after DNS issues clear to see whether the grade moves.
Raise your grade
Run the free checker against your domain to see your score, then turn the findings into a concrete, ordered remediation plan.