Checkup
Your email health report, and the score behind it.
Every record a receiving mail server reads, checked against the specification it is judged by. You get a score, the conditions behind it, and the exact line to publish for each one.
How the Vitals score is worked out
A single number is only worth having if you can reproduce it. This one is four separate questions, each answered out of 100 and then weighted, rather than one pool everything subtracts from. That difference matters: under a single pool, a domain publishingp=reject could score zero because four unrelated findings happened to add up past 100, which said a well defended domain was as exposed as one with no DNS at all.
The four pillars
| Pillar | The question it answers | Weight |
|---|---|---|
| Impersonation defence | Can somebody send mail that looks like it came from you? | 45 |
| Delivery integrity | Will the mail you really send arrive? | 25 |
| Visibility | Would you find out if either went wrong? | 15 |
| Hardening | Optional protections that no receiver requires but good senders publish. | 15 |
Impersonation carries the most weight because it is the failure that ends up in a news story. Hardening carries the least because no receiver requires any of it. A pillar cannot fall below zero, so one catastrophe can no longer drag the whole number to nothing.
What each finding costs
| Triage | Points off its pillar | What it means |
|---|---|---|
| Critical | 40 | Somebody can act on this against you today. |
| Urgent | 25 | Mail is being lost or trust is being spent right now. |
| Needs attention | 15 | A real gap, with time to close it properly. |
| Minor | 8 | Worth tidying on the next change you make. |
| Note | 2 | An observation, not a fault. |
Each distinct finding is charged once however many times it appears, and findings that do not apply to your domain are never charged at all. A domain that only receives mail is not marked down for a missing BIMI record it has no use for.
What absence costs
Subtraction alone cannot say you have nothing. Every finding above is a fault in something you published, so a domain that publishes nothing collects almost no findings and keeps almost all of its marks. A domain registered minutes ago, with no SPF, no DMARC and no MX, used to score 100 out of 100 on visibility, because there was no DMARC record for a missing reporting address to be a fault in.
So three absences hold down the pillars they belong to, whatever else is tidy. No DMARC record means a receiver has no instruction to refuse forged mail and no report is ever sent to you, so impersonation and visibility both answer themselves. No SPF record means nothing states which servers may send for you. A domain that does not resolve at all has no zone to score. The explainer beside your result names which one applied, if any.
The floor and the ceiling
Two rules keep the number and the words beside it telling one story. If the spoofability verdict is Protected, impersonation cannot score below 55, because receivers are refusing unauthenticated mail whatever else is missing. If the verdict isSpoofable, the total cannot rise above 39, because a domain anybody can send as does not get to look healthy on the strength of its CAA record.
Reading the bands
| Score | Band | What it means |
|---|---|---|
| 85 to 100 | Healthy | Nothing serious is wrong. Tune-ups at most. |
| 65 to 84 | Needs care | Real gaps that are costing you something measurable. |
| 40 to 64 | At risk | Serious conditions across more than one record. |
| 0 to 39 | Critical | Somebody can impersonate you, or your mail is failing outright. |
What the checkup reads
SPF with the whole include chain walked and counted, DKIM across the selectors your mail actually uses, DMARC including the tree walk that decides which policy a subdomain inherits, MX, PTR and forward-confirmed reverse DNS, DNSSEC, MTA-STS, TLS-RPT, BIMI and CAA. Every finding cites the specification it comes from, and every one of them hasa page explaining it.
Common questions
Why did my domain score badly when my DMARC policy is p=reject?
It should not, and that was a real defect until the score was rebuilt around four pillars. A domain publishing p=reject cannot fall below 55 out of 100 on impersonation, whatever else is missing, because the verdict is computed from the policy a receiver will actually apply. If you are seeing otherwise, send us the domain.
Why can a tidy domain still be capped below 40?
Because anybody can send mail as it. If the spoofability verdict is Spoofable, the score cannot rise above 39 however good the rest of the setup is. A CAA record is not a defence against impersonation and the number should not pretend it is.
The same problem appears three times. Is it charged three times?
No. Each distinct finding is charged once however many times it is found. Three DKIM selectors carrying 1024-bit keys is one problem with one fix. Every instance is still listed so you know which selectors to rotate.
Do the DMARC report findings change my score?
No. Bloodwork findings describe last week’s mail rather than today’s DNS, and a quiet week would otherwise flatter a broken domain. They are shown beside the score, never inside it.
Is the score comparable between two domains?
Within reason. Two domains with the same records get the same number, and findings that do not apply are never charged: a domain that only receives mail is not marked down for missing BIMI. It is a diagnosis of one domain rather than a league table.
Where to go next
- The Lab, if you want one record at a time rather than all of them.
- How SPF, DKIM and DMARC fit together, if the report used a word you did not recognise.
- The DMARC guide, if the answer was that you need a policy.
- Bloodwork, if you already have DMARC reports arriving and nothing to read them with.
Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.