Introducing MailShield Security Scoring
We built MailShield because email security monitoring was too fragmented and too technical. One of the clearest symptoms of that problem: there was no simple way to answer the question "how secure is my domain's email?"
Today we're introducing MailShield Security Scoring, a single 0-100 score that tells you exactly where your domain stands, what's working, and what needs attention.
Why a score matters
Email security involves eight different protocols, each with its own configuration, its own failure modes, and its own best practices. Asking a non-technical stakeholder to evaluate SPF lookup counts or DMARC alignment modes is unrealistic.
A score changes the conversation. Instead of "our DMARC policy is p=none with relaxed alignment," you can say "our email security score is 62 out of 100. Here's what we need to do to improve it." It makes email security accessible to everyone on your team, from the IT administrator to the CEO.
How it works
Your security score is calculated by evaluating your domain across all eight email security protocols (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, DNSSEC and DANE) plus its MX records.
Each protocol contributes to the overall score, weighted by its importance to your domain's email security. The core authentication protocols (SPF, DKIM, DMARC) carry the most weight because they have the biggest impact on deliverability and impersonation protection. Your MX setup and the supporting protocols (MTA-STS, TLS-RPT, BIMI, DNSSEC and DANE) make up the rest.
Score ranges
We map the 0-100 score to letter grades that make the assessment immediately understandable:
- A, 90-100 (Excellent): your email security is comprehensive. All major protocols are properly configured and your domain is well protected.
- B, 80-89 (Good): strong foundations with a few gaps. A handful of improvements gets you to full protection.
- C, 70-79 (Fair): core authentication is in place, but important protections are missing or not enforced.
- D, 60-69 (Poor): significant gaps remain. Your domain is partly exposed to spoofing and delivery problems.
- F, below 60 (Critical): critical email security configurations are missing or misconfigured. Your domain is at risk.
What the score measures
For each protocol, we check multiple factors:
- Presence: is the record published? Is it syntactically valid?
- Configuration quality: is the SPF record under 10 lookups? Is the DMARC policy stronger than p=none? Are DKIM keys using strong algorithms?
- Best practices: is there a DMARC reporting address? Does the MTA-STS policy use enforce mode? Are TLS certificates valid and not expiring soon?
- Consistency: do the protocols work together? Does DKIM alignment match the DMARC policy? Do MX records match the MTA-STS policy?
Improving your score
Your score isn't just a number. It comes with specific, actionable recommendations. We tell you exactly what's lowering your score and what to do about it, prioritized by impact.
For example, adding a DMARC record to a domain that doesn't have one is typically worth more points than adding BIMI to a domain that already has strong authentication. We help you focus on the changes that matter most.
Your score updates automatically: every domain is rechecked every 2 hours, and you can run a check yourself at any time. Fix an issue, and the next check shows the improvement. This creates a natural feedback loop that makes email security feel achievable rather than overwhelming.
Try it now
Add your domain to MailShield and see your security score in under a minute. It's free for 1 domain, no credit card required, and Pro starts at €4 per domain per month. See where you stand, understand what needs to improve, and track your progress over time.