How we grade
The free grade is plain code. We do not use AI to pick the score. Every check reads public information: DNS lookups, the public certificate list, and one normal visit to the home page. We do not scan ports, guess passwords, or crawl the site.
The score is out of 100. A is 90 or above, B is 80, C is 70, D is 60, and F is below 60. The score is the share of points earned out of the points we could check. A check marked "Not counted" adds nothing to either side, so the score always matches the list.
| Area | Points | What we look at |
|---|---|---|
| 35 | Sender list, SPF (12). Email signature, DKIM, on common names (8). Spoofing note, DMARC (10). Secure delivery, MTA-STS (3). Encryption reports, TLS-RPT (2). | |
| Website lock | 25 | Secure address works (10), certificate date (5), http jumps to https (5), browsers stick to https, HSTS (5). |
| Extra headers | 15 | Content rules (4), file-type hint (3), frames (3), link sharing (3), browser permissions (2). |
| Domain records | 15 | Signed records, DNSSEC (8). Who may create a certificate, CAA (4). At least two answering servers (3). |
| Loose ends | 10 | Names that point nowhere (6), insecure pieces on the home page (4). |
Limits on the letter
- If the secure website does not load, the grade stops at D, even if the other points are high.
- If the domain receives email and has no DMARC record at all, the grade stops at C.
Words on the report
- SPF, the sender list: who may send email for this domain.
- DKIM, the email signature: a public key so inboxes can check that a message really came from that sender.
- DMARC, the spoofing policy: what other mail companies should do when a message fails those checks.
- HSTS: a note that asks browsers to keep using the secure (https) address.
- CAA, certificate permission: which companies may create a website certificate for this domain.
- DNSSEC: a signature on the domain's records, so they are harder to swap on the way to a visitor.
- DANE: an extra certificate note stored in DNS. Many small sites never add it. It is not part of the grade.
Not part of the score
A logo in the inbox (BIMI), a newer-style internet address (IPv6), and the extra certificate note (DANE) are shown as notes. We do not check old encryption versions. That needs a deeper look than a normal page load.
When a source is down
If the public certificate list, the name servers, or the home page do not answer, those checks are marked "Not counted". They do not lower the score, and they do not raise it either.
Domains that do not receive email
If a domain has no mail server, or a "null MX" that says it takes no mail, secure delivery (MTA-STS) and encryption reports (TLS-RPT) are not counted. The email signature (DKIM) is not counted either unless the sender list names someone who sends for the domain. The sender list (SPF) and spoofing policy (DMARC) still count, because anyone can send fake mail that claims to be from any domain. For a domain that sends no mail, the safe setup is v=spf1 -all and a DMARC policy of reject.
What the points prefer
- SPF should be one record, end in -all (or ~all for partial credit), and stay under 10 DNS lookups.
- DMARC scores more for quarantine or reject than for a watch-only policy. A watch-only policy still counts as having DMARC, so it avoids the grade cap.
- DKIM is a pass when a usual name has a real public key, or points at the email company. An empty key does not count. Your email company might use a name we do not check. The fix kit tells you where to copy their record.