Appearance
Security Score
MailShield gives every verified domain a security score from 0 to 100, based on the DNS records and mail server settings it checks. This page explains how the score is calculated. For what to fix first, see Improving Your Score.
Grades
| Grade | Score | Label |
|---|---|---|
| A | 90-100 | Excellent |
| B | 80-89 | Good |
| C | 70-79 | Fair |
| D | 60-69 | Poor |
| F | 0-59 | Critical |
A domain shows Not verified until you verify ownership, and Not checked until its first check has run.
Where to See It
- The domain's Overview shows the grade, the score and a Score history chart.
- Checks → Summary shows the score breakdown: the points each component earned. You can also get there with How is this calculated? on the Overview.
MailShield recalculates the score after every check. Checks run every 2 hours; click Run Checks in the domain header to check right away.
The Score Depends on the Usage Type
When you add a domain, you choose how it's used: Sends and receives email, Only sends email, Only receives email or Parked domain. The usage type decides which components count and how much each is worth. Components that don't apply show as N/A and don't count against you. You can change the usage type under Domain → Settings → Email Configuration.
Maximum Points per Component
| Component | Sends and receives | Sends only | Receives only | Parked |
|---|---|---|---|---|
| MX | 10 | 10 | 15 | 10 |
| SPF | 18 | 22 | 15 | 15 |
| DKIM | 10 | 20 | N/A | N/A |
| DMARC | 25 | 25 | 20 | 25 |
| MTA-STS | 10 | N/A | 15 | N/A |
| TLS-RPT | 10 | N/A | 10 | N/A |
| BIMI | 2 | 8 | N/A | N/A |
| DNSSEC | 10 | 15 | 15 | 10 |
| DANE | 5 | N/A | 10 | N/A |
| Total | 100 | 100 | 100 | 60, scaled to 100 |
A parked domain can earn 60 points, which MailShield scales to 100. For example, 50 of 60 points shows as 83.
How Each Component Scores
MX
| Usage type | Points |
|---|---|
| Sends and receives | 5 for MX records, plus 5 when every MX host supports STARTTLS |
| Receives only | 10 for MX records, plus 5 when every MX host supports STARTTLS |
| Sends only | 10 when your MX hosts accept mail (so bounces reach you), 5 when they're published but unreachable or don't resolve, 0 for a null MX |
| Parked | 10 for a null MX (MX 0 .) or no MX records, 5 when MX records exist but can't receive mail |
Certificate problems cost the MX points
If an MX host serves a certificate that fails verification (a name that doesn't match the host, a self-signed certificate or an untrusted chain), the MX component drops to 0. For sends-only domains it's capped at 5. Senders that verify TLS, for example because you publish MTA-STS in enforce mode or DANE, refuse to deliver to such a host.
SPF
Points for a valid SPF record, by how it ends:
| Record ends in | Sends and receives | Sends only | Receives only | Parked |
|---|---|---|---|---|
-all | 18 | 22 | 15 | 15 |
~all | 13 | 17 | 8 | 8 |
?all, +all or no all | 10 | 12 | 0 | 0 |
A missing or invalid record earns 0. Domains that don't send mail should publish v=spf1 -all.
DKIM
Counts for domains that send mail.
| Criteria | Sends and receives | Sends only |
|---|---|---|
| A valid selector with a 2048-bit (or larger) RSA key, or an Ed25519 key | 10 | 20 |
| Valid selectors, but only 1024-bit RSA keys | 7 | 14 |
MailShield learns your selectors from DMARC reports, or you can add them under Checks → DKIM. Until it knows a selector, DKIM isn't scored: the breakdown shows Not scored yet, and the total is scaled over the remaining points, so this costs you nothing. Once a selector is known, DKIM earns 0 if none of the known selectors has a valid key.
DMARC
All DMARC points require a valid record.
| Criteria | Sends and receives | Sends only | Receives only | Parked |
|---|---|---|---|---|
| Valid DMARC record | 5 | 5 | 0 | 0 |
p=reject | +10 | +10 | +10 | +15 |
p=quarantine | +7 | +7 | +6 | +10 |
p=none | +2 | +2 | 0 | 0 |
A rua reporting address | +5 | +5 | +5 | +5 |
Your MailShield Reporting address in rua, or a ruf address | +5 | +5 | +5 | +5 |
| Maximum | 25 | 25 | 20 | 25 |
With pct below 100, the policy applies to only that share of failing mail and the next weaker policy to the rest, so it earns that share of the step up from the weaker policy. For example, p=quarantine; pct=50 on a domain that sends and receives earns 5 of the 7 policy points (halfway between 2 and 7, rounded). A subdomain policy (sp=) weaker than p= costs half the difference between the two: p=reject; sp=none on the same domain earns 6 policy points instead of 10.
Your Reporting address is shown on the domain's Overview. See Adding a Domain.
MTA-STS
Counts for domains that receive mail.
| Criteria | Sends and receives | Receives only |
|---|---|---|
| Valid MTA-STS policy | 5 | 8 |
mode: enforce | +5 | +7 |
mode: testing | +2 | +3 |
TLS-RPT
Counts for domains that receive mail.
| Criteria | Sends and receives | Receives only |
|---|---|---|
| Valid TLS-RPT record | 5 | 5 |
rua includes your MailShield Reporting address | +5 | +5 |
rua points somewhere else | +3 | +3 |
BIMI
Counts for domains that send mail: 2 points (sends and receives) or 8 points (sends only) for a valid BIMI record whose logo passes validation. The record only counts as valid with DMARC at p=quarantine or p=reject and no pct below 100, and the logo must be SVG Tiny PS. Only the latest BIMI check counts, so a record that has broken since loses the points. BIMI shows your logo but blocks nothing, so it's weighted lightly.
DNSSEC
10 points (sends and receives, parked) or 15 points (sends only, receives only) when DNSSEC is enabled and validates.
DANE
Counts for domains that receive mail: 5 points (sends and receives) or 10 points (receives only) when your MX hosts publish TLSA records in a DNSSEC-signed zone. TLSA records in an unsigned zone don't count, because senders ignore them. If the TLSA records on any MX host no longer match the certificate it serves, DANE earns 0: senders that validate DANE refuse delivery to that host.
Reaching an A
An A needs 90 points. The core records for each usage type (MX, SPF, DKIM and DMARC, plus MTA-STS and TLS-RPT for domains that receive mail) add up to 75-83 points: a B or a C. DNSSEC usually closes the gap. Improving Your Score shows the path for each usage type.
Score Alerts
MailShield can alert you when a domain's score moves by 10 or more points, or its grade changes, once two checks in a row confirm the new score. When MailShield updates its scoring rules, scores move without an alert. See Alerts.