Improving Your Score

This page covers what to fix, and in which order. For the full points breakdown, see Security Score.

Start Here

1. Check the usage type. Open the domain and look at the badge next to its name. If it's wrong, change it under Settings → Email Configuration. A parked domain scored as "Sends and receives" loses points for records it doesn't need.
2. Make sure the domain is verified. Unverified domains aren't scored. See Adding a Domain.
3. Open Checks → Summary. The score breakdown shows which components are missing points. The Overview also lists the next fixes, such as "Set up DMARC" or "Route DMARC reports to MailShield".

What It Takes to Reach an A

An A needs 90 points. This table shows the records that earn the most for each usage type, and what's still needed after them.

Usage type	Core records	Core total	Needed for an A
Sends and receives	MX with STARTTLS, SPF ending in -all, DKIM with a 2048-bit key, DMARC at p=reject with your Reporting address, MTA-STS in enforce mode, TLS-RPT with your Reporting address	83 (B)	DNSSEC (+10). DANE (+5) and BIMI (+2) add the rest.
Sends only	MX that accepts bounces, SPF ending in -all, DKIM with a 2048-bit key, DMARC at p=reject with your Reporting address	77 (C)	DNSSEC (+15). BIMI (+8) adds the rest.
Receives only	MX with STARTTLS, SPF v=spf1 -all, DMARC at p=reject with your Reporting address, MTA-STS in enforce mode, TLS-RPT with your Reporting address	75 (C)	DNSSEC (+15) gets you to 90. DANE (+10) adds the rest.
Parked	Null MX, SPF v=spf1 -all, DMARC at p=reject with your Reporting address	83 (B)	DNSSEC, which takes the domain to 100

"Your Reporting address" means the MailShield address shown on the domain's Overview. Putting it in the rua tag of DMARC and TLS-RPT is worth 5 points each, and it's how MailShield receives your reports.

Fix Things in This Order

The order below keeps mail flowing while you tighten things up.

1. Publish DMARC with your Reporting address. Start at p=none for domains that send mail, so reports start arriving before anything is enforced. Parked and receive-only domains can go straight to p=reject.

   v=DMARC1; p=none; rua=mailto:abc123@reports.mailshield.app

   Replace abc123@reports.mailshield.app with your domain's full Reporting address, shown on the domain's Overview page in MailShield.

2. Fix SPF. Include every service that sends as your domain. Once the reports show nothing legitimate failing, end the record with -all instead of ~all (worth 5 points on sending domains). See Third-Party Senders.

   v=spf1 include:_spf.google.com -all

3. Set up DKIM for every service that sends as your domain, with 2048-bit keys. MailShield finds selectors in your DMARC reports, or you can add them under Checks → DKIM.

4. Move DMARC to enforcement: p=quarantine, then p=reject. The DMARC Enforcement Roadmap walks through it, and Reports → DMARC Progression tells you when a domain is ready.

5. For domains that receive mail: add TLS-RPT with your Reporting address, then MTA-STS in testing mode, and switch to enforce once the TLS reports are clean. MailShield can host the policy for you: see MTA-STS Hosting.

6. Turn on DNSSEC at your DNS provider, then publish the DS record at your registrar. See DNSSEC.

7. Optional extras: DANE for your MX hosts, which needs DNSSEC (DANE), and BIMI once DMARC is enforced (BIMI).

Common Reasons for Lost Points

Symptom	Cause	Fix
MX shows 0 points	An MX host serves a certificate with the wrong name, a self-signed certificate or an untrusted chain	Install a valid certificate for the MX host name
DANE shows 0 points although TLSA records exist	The TLSA records no longer match the certificate the server serves, or their zone isn't DNSSEC-signed	Publish a TLSA record for the current certificate, and sign the zone. See DANE
DKIM shows Not scored yet	No DMARC report has shown which selector you use. It costs no points meanwhile	Wait for DMARC reports, or add the selector under Checks → DKIM
DKIM shows 0 points	None of the selectors MailShield knows has a valid key	Publish the key, or add the selector you actually sign with under Checks → DKIM
DKIM earns only part of its points	Only 1024-bit RSA keys are published	Rotate to a 2048-bit key
DMARC is missing 5 points	Reports go somewhere else	Add your Reporting address to rua
DMARC is missing a few policy points	pct is below 100, or sp= gives subdomains a weaker policy than p=	Remove pct= (or set it to 100), and remove sp= or set it to match p=
BIMI shows 0 points although the record exists	DMARC isn't at p=quarantine or p=reject with no pct below 100, or the logo isn't SVG Tiny PS	Enforce DMARC, and publish the logo as SVG Tiny PS. See BIMI
TLS-RPT is missing 2 points	TLS reports go somewhere else	Add your Reporting address to rua
MTA-STS is missing points	The policy is in testing mode	Switch to enforce once TLS reports are clean

Keeping Your Score

• Watch for changes. Score and DNS change alerts tell you when something drops. See Alerts.
• Recheck after changes. Checks run every 2 hours. After you change DNS, click Run Checks in the domain header to see the result right away.
• Review the trend. The Score history chart on the domain's Overview shows when the score changed.
• Keep certificates current. An expired or mismatched MX certificate costs points and can stop mail. The Certificate expiry alert warns you 14 days ahead, and when a new certificate problem appears.

Next Steps

• DMARC Enforcement Roadmap: progress to p=reject
• Third-Party Senders: configure every service that sends as you
• Email Source Discovery: find senders you've missed