Guide
How the email spoofing scorecard weighs SPF, DMARC, DKIM and transport security
Anyone can type your domain into the From field of an email. Whether the message is accepted depends on what receivers find in your DNS. This scorecard checks the records that decide it, adds up a score out of 100 and lists, line by line, what to fix first. The result describes configuration, not delivery.
How the points are assigned
DMARC (40 points) counts the most. p=reject earns 40, or 34 if pct is below 100; p=quarantine earns 30; p=none earns 8; no record or an invalid one earns 0. SPF (25): a valid record ending in -all earns 25 and ~all earns 22; no all term earns 12; +all, ?all or a record with an error earns 5; none earns 0. DKIM (15): keys found among 15 common selector names earn 15, or 8 if all of them are RSA keys under 2048 bits; none found earns 6. MTA-STS (8), TLS-RPT (4), DNSSEC (5) and MX (3) are smaller, optional items that show care for transport security. The risk is Low from 80, Medium from 50 and High below.
Why DKIM is a partial check
DKIM selectors are arbitrary names, and the only reliable way to learn one is to read it from a message. The scorecard tries 15 common names such as google, selector1, k1, s1 and default. If none is found, the item scores 6 of 15 with the note that your provider may use a different selector. To be sure, use the DKIM Record Checker with the selector from a real message header.
Domains that send no mail
A domain with SPF -all as its only term and either no MX or a null MX is treated as a non-sending domain. For these, a missing DKIM key is fine and scores in full, and the page adds a notice to complete the protection with DMARC p=reject. Parked and legacy domains are the typical case and are favourite targets for spoofing because owners forget them.
Reading the checklist
The table has one row per check: the result (Good, Weak, Missing or wrong, or Optional), points earned out of the maximum, and a sentence on what was found with a suggested fix. It ends with the number of DNS queries made, around forty-five, since each selector and each include costs a lookup. Work through the checklist from the top: DMARC enforcement first, then SPF correctness, then DKIM, and treat the optional items as later improvements.
A worked example
Press Sample to score github.com. When this guide was reviewed it scored 70 / 100, risk Medium: SPF Good (22 of 25, ends with ~all, 10 of 10 lookups used), DMARC Good (30 of 40, p=quarantine, advice to move to reject), DKIM Good (15 of 15, six keys found with a note that two use RSA keys under 2048 bits), MTA-STS, TLS-RPT and DNSSEC Optional with 0 points each, and MX Good (3 of 3). Records change, so a repeat may differ.
Limits
The test reads public DNS only. It cannot see how receivers actually treat your mail, whether your servers sign with the keys it found, or whether your DMARC reports show failures. A high score does not guarantee inbox delivery, which also depends on reputation and content. The detail behind each line is in the SPF Record Checker, DMARC Checker and MTA-STS Generator.
Related tools
- DMARC Checker gives the full analysis of the policy.
- SPF Record Checker follows includes and counts lookups.
- DKIM Record Checker inspects a key by selector.
- MTA-STS Generator writes the transport policy the scorecard rewards.
Checked against the current version of the Email Spoofing Test on .