← Email Score

How Email Score calculates your score

Last updated: 23 September 2026

This page documents the complete scoring model, exactly as the scanner implements it — no hidden weights, no guesswork. Every check reads publicly available DNS records, so you can verify any result yourself. The checks follow the email-security standards recommended by the UK's National Cyber Security Centre (SPF, DKIM, DMARC, TLS). Email Score is not certified or endorsed by the NCSC.

The scoring model

Your 0–100 score is the sum of three email-authentication checks:

A check that cannot be completed (for example, a DNS lookup that fails outright) is marked UNKNOWN and shown as "Not confirmed". It contributes 0 points and is never counted as a pass or a fail — we say so rather than guess.

Is this an industry standard?

No. There is no universal 0–100 email-security score and no recognised certification behind these numbers. Email Score uses our own configuration-health model, which we created to give non-technical business owners a single, honest indicator of how their domain authentication is set up. The individual checks follow published standards (the RFCs linked above), but the weighting, the partial-credit value and the grade bands are our product design choices — published here in full so anyone can challenge them.

Why is a WARNING worth exactly 15 points?

15 is a deliberate middle weighting, not a measured constant. A WARNING means the record exists but isn't enforcement-grade — for example an SPF policy that ends neutrally (?all or +all) or lacks an enforcement qualifier, or a DMARC policy at p=none (monitor-only). That is meaningfully better than having nothing (0 points), because the groundwork is published and reports flow, but it is well short of full protection, so it earns well under half of the check's full value. We chose 15 to keep a single WARNING from flattering a score into a top grade: three WARNINGs score 45 (grade F territory), while any two full passes plus a partial stay in the 80s.

Letter grades

What each check looks for

SPF — Sender Policy Framework

We look up the TXT records on your domain and check that exactly one SPF record exists (RFC 7208 forbids multiple records — receivers fail the evaluation). The record is validated for syntax, and the include: chain is resolved with the DNS lookup budget in mind. A record ending in ~all or -all (or using redirect=) scores full marks. A record with a neutral ?all or permissive +all, or one that lacks a strict enforcement qualifier, scores partial. No record — or duplicate records — scores zero.

DKIM — DomainKeys Identified Mail

DKIM signing keys are published at DNS addresses chosen by your email provider, so we query 40+ standard provider selectors (Google Workspace, Microsoft 365 and common defaults) for a public key. A valid published key scores full marks. If no standard selector matches, the check is marked failed and the confidence rating is reduced — because some providers use custom selectors we cannot enumerate, and we would rather flag that than stay silent.

DMARC — Domain-based Message Authentication, Reporting & Conformance

We look for a _dmarc TXT record on your domain, falling back to your organisational domain. A single record with an enforcement policy (p=quarantine or p=reject) scores full marks. A monitoring-only policy (p=none), or duplicate records (which receivers ignore), scores partial. No record scores zero. The record is validated for syntax, and reporting addresses (rua) are reported.

Confidence rating

Every result carries a confidence rating that tells you how much certainty sits behind it. It starts at 100% and is reduced when the scan hits a situation a DNS check cannot fully resolve:

• −15% — Cloudflare Email Routing or a custom email service detected without an explicit DKIM match
• −10% — no public DKIM selector matched across the 40+ standard queries
• −5% — DMARC policy set to passive monitoring (p=none)
• −5% — unusually dense SPF include chain (many third-party includes)

The rating is clamped to 50–100% and reported as High certainty, Moderate, or Complex — where a manual audit is recommended. Low confidence never changes the score; it changes how much you should trust a single result.

Checks that don't affect your score

The scan also reports five advisory checks. They indicate maturity beyond baseline authentication, so they are shown and explained but deliberately excluded from the 0–100 score:

• BIMI — brand logo display in supporting inboxes
• MTA-STS — TLS policy for mail transport
• TLS-RPT — reporting for TLS failures
• DNS blocklists — Spamhaus, Barracuda, SORBS and SpamCop listings
• WHOIS — registrar, domain age and expiry

What this test cannot tell you

Email Score measures published email-authentication configuration — nothing else. It cannot tell you:

• whether a specific message reached someone's inbox
• your sender or IP reputation at any provider
• the quality of your email content or mailing lists
• recipient engagement (opens, replies, spam complaints)
• whether future messages will be delivered

Every report is a point-in-time snapshot of the DNS records observed when the scan ran. It is not a security certification and not a guarantee of inbox placement.

Verify our results yourself

Because every check reads public DNS records, any result can be independently confirmed — with your DNS provider's console, any DNS lookup tool, your IT provider, or the NCSC's own Mail Check service. If we report a missing or broken record, you can check it yourself in seconds. See our verification and company page for more.