Scoring model

One assessment: the gap list

Every check produces a single list of open gaps. The score, the band, the gauge chips, and the recommendations are all derived from that one list, so they can never disagree. Each gap belongs to exactly one class, and each class has a fixed point cost:

How the number is produced

A domain with no open gaps scores 95. The last five points are earned by hardening: DMARC p=reject (+2), MTA-STS in enforce mode (+1), verified DANE (+1), and a valid BIMI VMC (+1). A score of 100 therefore means enforced and hardened, and it can never appear alongside an open gap. When gaps are open, the score is 100 minus the total gap cost, held at 94 or below so an open gap can never reach the Excellent band, and capped at 45 whenever a Blocker is present.

Because each gap has a fixed cost, every recommendation states exactly what fixing it earns back. Clearing a Blocker usually gains more than its listed cost, because removing the last Blocker also releases the 45-point cap.

Bands

Excellent (95 and above, requires zero gaps), Good (85 to 94), Needs attention (70 to 84), At risk (50 to 69), and Critical (below 50). A Major or Minor gap holds the band at Good or lower; a Blocker holds it at At risk or lower.

Unverified records never count against you

A DNS lookup that times out is not the same as a record that does not exist. When a lookup fails to resolve, that record is reported as unknown rather than missing, no gap is raised for it, and the previously confirmed score is shown with a Last known score badge. Score-change alerts are suppressed for those runs, so a resolver problem on our side can never look like a problem with your domain.

Profiles decide what applies

Expectations follow how the domain sends mail. An ESP-delegated domain is not penalized for a closed apex SMTP port or for DKIM keys its provider manages, and a parked domain is not expected to publish authentication records at all. Those findings become advisories for that profile instead of gaps.

Domain health score (0-100)

The Deliverability tab health score uses seven categories that sum to 100. Each category starts at its maximum weight. Findings subtract points from the relevant category only. The final score is the sum of category scores (after bonuses and hard caps).

Category weights (maximum points)

Point deductions by finding

Each row is the base deduction before multipliers. Actual points subtracted may be lower when severity, confidence, applicability, or domain profile reduce impact (for example provider-managed DKIM on ESP-delegated domains). Deductions never exceed the category bucket they belong to.

SPF (from 20)

spf_softfail_all (~all) is flagged as a policy recommendation but does not deduct points by default (common on enterprise and mailbox-provider domains).

DKIM (from 20)

1024-bit keys are noted but not penalized; 2048-bit is recommended. ESP-delegated and mailbox profiles may treat DKIM as provider-managed with no deduction.

DMARC (from 25)

p=reject has no deduction and may earn a +2 bonus (see below).

MX (from 10)

SMTP transport (from 10)

ESP-delegated and mailbox-provider domains may skip SMTP transport scoring (category marked neutral).

DNS integrity (from 5)

Policy security (from 10)

Score bonuses (up to +6 total)

Hard caps (maximum score when condition is true)

Even if category math is higher, critical failures cap the final score:

Classification labels

Worked example

Domain with valid SPF, valid DKIM, DMARC p=none, MX ok, SMTP ok

SPF:             20 − 0  = 20
DKIM:            20 − 0  = 20
DMARC:           25 − 4  = 21   (dmarc_none)
MX:              10 − 0  = 10
SMTP transport:  10 − 0  = 10
DNS integrity:    5 − 0  =  5
Policy security: 10 − 0  = 10
                              ────
Total:                       96  (excellent)

IP composite score (0-100)

IP monitors use five weighted dimensions. If SMTP or TLS cannot be probed (common on managed ESP IPs), that dimension is marked unobservable and its weight is redistributed to the others.

Common IP signal impacts

Blacklist and monitor headline score

Blacklist listings on the domain health breakdown are noted in reputation notes; the dedicated blacklist reputation score (Monitor / Blacklists tab) uses vendor weight × severity × confidence. The headline score on Monitor and asset Overview blends blacklist state, deliverability health, and trend. See Blacklist monitoring.

Reading the Deliverability tab

• Green gauge: no open gaps
• Amber gauge: mail delivers, but Major or Minor gaps are open; the gauge shows how many
• Red gauge: a Blocker is open, so the score is capped and mail is at real risk
• Card badges: Blocker, Gap, or Minor gap matches the same gap list the gauge counts, so a card never disagrees with the headline
• Last known score: a DNS lookup did not resolve on this run, so the previous confirmed score is shown instead of a partial measurement
• Recommended actions: prioritized fixes, each stating the points it earns back

← How checks work · Domain identity →