Email security grade: SPF, DKIM, DMARC, and MX in one score

How to read this

This grade is not the full Client Posture score. It uses only four public checks: SPF, DKIM, DMARC, and MX, and the same severity table as the product scorer: 1=2 points, 2=5, 3=10, 4=15, 5=25. Only Verified fail (full weight) and Verified warn (half) deduct. Unknown, info, pass, and Not tested cost zero.

Each row shows the points that check can take off and the points it actually took off. A missing DMARC or SPF is a severity-4 fail (15). Monitoring Mode / p=none is a severity-3 warn (5). Quarantine is a severity-2 warn (2.5). SPF ~all is a severity-2 warn (2.5). Two SPF records or more than ten lookups are a severity-3 fail (10). A revoked DKIM key is a severity-3 fail (10). A miss on common DKIM selectors is Unknown and costs nothing.

“Fix these first” lists up to three Verified issues only, sorted by fail-before-warn, then severity. Unknowns go in a separate “Worth confirming” list and never deduct. The heading says “Fix these 3 first” only when there are three.

The shareable URL is /tools/email-security-grade/<domain>. Per-domain pages are noindex and canonicalize back to the hub so they do not create thin SEO copies. Anyone with the link can re-run the same public lookups. Results change when DNS changes; this is not a certificate.

A named MX (Microsoft 365, Google Workspace, Proofpoint, and the rest of that list) is informational and costs zero. No MX records is a verified severity-5 fail (25) — that is “cannot receive mail,” not a provider name. We will not claim Microsoft Defender or Abnormal from MX.

Share the URL when the number would help the conversation, not as a trophy. If you are an MSP, the grade is the hook; the verified list is the work order. The white-label report in the product is the thing you leave behind with your logo on it.

Scoring is arithmetic. A verified fail subtracts the table weight. A verified warn subtracts half, shown as a decimal so 97.5 is not rounded to 98. Letter cut-points are the same as the product: 90 A, 80 B, 70 C, 60 D, else F.

DKIM with a published key is a pass even at 1024-bit — the weakness is called out in the row. A dangling selector CNAME is Unknown, not a fail. If DNS times out on one check, that row stays Unknown and the letter is computed from the rest.