Email Security Grading Rubric
How we calculate the A–F grade on /tools/email-checker. Published in full so you can audit, argue with, and replicate our scoring.
Base score
Every domain starts at 100. We subtract points for issues found in each of seven categories.
Letter grade thresholds
| Score | Grade | Label |
|---|---|---|
| ≥ 90 | A | Excellent |
| 80 – 89 | B | Good |
| 60 – 79 | C | Fair |
| 40 – 59 | D | Poor |
| < 40 | F | Critical |
Deduction categories
SPF (max −30)
- No SPF record: −30
- SPF allows all senders (
+all): −30 - SPF neutral (
?all): −20 - SPF soft-fail (
~all): −15 - Exceeds 10 DNS lookups (RFC 7208): −5
DMARC (max −30)
- No DMARC record: −30
- Policy is
p=none: −15 - Policy is
p=quarantine(rather than reject): −5 - No aggregate reports address (
rua=): −5
DKIM (max −20)
- No DKIM found at common selectors: −20
MX (max −20)
- No MX records: −20
MTA-STS — RFC 8461 (max −8)
- No MTA-STS policy: −8
- Policy declared but file unreachable / invalid: −8 (attacker-observable inconsistency)
- Policy in
mode=testing: −3 - Policy in
mode=none: −8 (equivalent to no policy)
TLS-RPT — RFC 8460 (max −2)
- No TLS-RPT record: −2
- Invalid syntax: −2
Note: we verify the TLS-RPT record syntax only. We do not ingest TLS-RPT reports on behalf of customers.
BIMI (max −3)
- BIMI declared but SVG unreachable: −3
- BIMI declared with minor issues (oversize SVG, missing VMC): −1
- No BIMI record: no deduction — BIMI is aesthetic, not security.
BIMI also requires DMARC p=quarantine or p=reject. If you publish BIMI with
DMARC p=none, receivers will not render the logo — we surface that as a BIMI-category deduction.
Why these weights?
SPF, DKIM, DMARC and MX get the heaviest weights because they determine whether mail is accepted at all and whether spoofing is blocked. MTA-STS and TLS-RPT are newer transport-security signals with lower enforcement today — we deduct, but not as aggressively. BIMI is brand-signalling, so absence is neutral; breakage is penalised because it signals a half-finished rollout.
The letter-grade thresholds are deliberately forgiving at the top (A = ≥90) so that a domain with perfect SPF/DKIM/DMARC/MX but missing MTA-STS still grades A. This keeps backward compatibility with scans produced before MTA-STS/TLS-RPT/BIMI were added to the rubric.
Suggestions or disagreements?
If you think a weight is off, email [email protected] with the domain and the weighting you'd expect — we publish this rubric precisely so people can argue with it.