Security Score

MailShield calculates a comprehensive security score for each domain, helping you understand and improve your email security posture.

Score Overview

Your security score is a number from 0-100, translated to a letter grade:

Grade	Score Range	Status
A	90-100	Excellent - Your email security is comprehensive
B	80-89	Good - Minor improvements possible
C	70-79	Fair - Several areas need attention
D	60-69	Poor - Significant gaps in security
F	0-59	Critical - Immediate action required

How the Score is Calculated

The score is weighted across different security categories:

Core Authentication (50 points)

Category	Points	Description
DMARC	25	Most important - enables reporting and enforcement
SPF	15	Specifies authorized senders
DKIM	10	Cryptographic email signatures

Transport Security (20 points)

Category	Points	Description
MTA-STS	10	Enforces TLS for email transport
TLS-RPT	10	Reports on TLS failures

Infrastructure (25 points)

Category	Points	Description
MX Records	10	Valid mail servers with TLS
DNSSEC	10	DNS response authentication
BIMI	5	Brand indicators

Bonus Points

Category	Points	Description
DANE	+5	Certificate pinning via DNS

Scoring Criteria

DMARC (25 points)

Criteria	Points
Valid DMARC record exists	10
Policy is quarantine	+5
Policy is reject	+10
Reporting configured (rua)	+5

SPF (15 points)

Criteria	Points
Valid SPF record exists	8
Uses -all (hard fail)	+4
Uses ~all (soft fail)	+2
No deprecated mechanisms	+3

DKIM (10 points)

Criteria	Points
At least one valid selector	5
Key length ≥ 2048 bits	+3
Multiple selectors configured	+2

MTA-STS (10 points)

Criteria	Points
Valid policy exists	5
Mode is testing	+2
Mode is enforce	+5

TLS-RPT (10 points)

Criteria	Points
Valid TLS-RPT record	10

MX Records (10 points)

Criteria	Points
Valid MX records exist	5
All servers support TLS	+5

DNSSEC (10 points)

Criteria	Points
DNSSEC enabled and valid	10

BIMI (5 points)

Criteria	Points
Valid BIMI record	3
Logo accessible	+2

Improving Your Score

Quick Wins

1. Add DMARC if missing - even p=none adds points
2. Configure reporting (rua) to receive DMARC reports
3. Enable TLS-RPT - simple DNS record addition

Medium Effort

1. Strengthen DMARC policy from none → quarantine → reject
2. Add MTA-STS policy to enforce TLS
3. Upgrade DKIM keys to 2048 bits or higher

Advanced

1. Enable DNSSEC at your registrar
2. Configure DANE for certificate pinning
3. Add BIMI for brand recognition

Score Alerts

MailShield can notify you when:

• Score drops by more than 10 points
• Rating changes (e.g., from B to C)
• Score falls below threshold (configurable)

Configure alerts in Settings → Notifications.

Score History

Track your security score over time:

• View historical scores on the domain dashboard
• See when changes occurred
• Correlate with DNS modifications

Best Practices for an A Rating

To achieve and maintain an A rating:

1. ✅ DMARC with p=reject policy
2. ✅ SPF with -all (hard fail)
3. ✅ DKIM with 2048-bit keys
4. ✅ MTA-STS in enforce mode
5. ✅ TLS-RPT configured
6. ✅ DNSSEC enabled
7. ✅ All MX servers supporting TLS