How the grade is built: 33 checks, 100 points

Your grade is a score out of 100, mapped to a letter. Twenty-four checks earn points, another nine are reported and earn nothing, and 40 of the 100 points sit on the email surface. A C means the domain scored between 70 and 79, which puts it above the F band that holds 74.3% of the 332,492,319 domains carrying a grade in the October 2026 census.

If you’ve got a result open while you read this, spend less time on the letter and more on the weights underneath it, because the weights are what show you which check to change.

The bands the score falls into

The scorer produces a whole number from 0 to 100 and reads it against six fixed cut-offs. A+ needs 95 or more, A needs 90, B needs 80, C needs 70, D needs 60, and anything below 60 is F. The cut-offs haven’t changed since the grading started, so a B on one domain means the same as a B on another.

The letter is coarse by design. A domain at 79 and a domain at 70 both show C, and the gap between them is a whole check’s worth of points. When you compare two results, compare the scores and the failing checks, and treat the letter as the name of the band.

Thirty-three checks, and the nine that can’t move the grade

The registry lists 33 checks in five groups: Email Security, TLS (Transport Layer Security) & Certificates, Web Security, DNS (Domain Name System) Security and Infrastructure. Twenty-four of them are scored. The other nine are informational. They still run and show in your result as pass or fail, and none of them carries points.

Three of the nine are TLS checks: tls-compression, ocsp-stapling and secure-renegotiation. They can’t be measured reliably from where the scanner sits, so they’re reported and left out of the sum. A domain can show all three as failing and still grade A+ at 100. If you fix one of them and the score doesn’t move, nothing is wrong with the scan; the check was never in the score to begin with.

The remaining six are the three cross-origin headers (coop-header, corp-header and coep-header), ipv6-support, and the two Infrastructure checks, cdn-waf-detection and hosting-provider. Those last two are fingerprints of what sits in front of the site, and there’s no fail state to score.

Where the 100 points sit

Each scored check has a weight, and the weights add up to 100 across the five groups.

A check doesn’t earn its weight all or nothing. Each one reports a score against its own maximum, and the scorer takes that fraction of the weight. DMARC policy is the clearest case: p=reject earns the full 8, p=quarantine earns about half of it, and p=none earns about a quarter. A weaker sp= policy for subdomains and a pct= value below 100 both pull the fraction down further.

The final score is the weight earned divided by the weight that applied to your domain, scaled to 100. The profile rule in the next section decides which weights apply to a given domain.

Why email is the biggest block

There are two reasons for the 40. The first is reach: the census finds an MX record on 180,462,439 of the 332,492,319 graded domains (54.3%), so for more than half of the graded internet, mail is a live surface and the three email-infrastructure checks (DKIM, MX records and reverse DNS) apply.

The second is that SPF and DMARC are scored whether or not the domain accepts mail, because forging a sender address needs nothing from the domain except a missing policy. Can someone spoof my domain? walks through how that forgery is sent.

The profile rule handles the rest. If your domain has no MX record, the scorer marks DKIM, MX records and reverse DNS not applicable and takes their 14 points out of the denominator. It then rescales the remaining weight so the score is still out of 100. A web-only domain is graded on what it presents, and it doesn’t lose points for a mail system it doesn’t run.

The weights also track who gets hurt. The web checks protect people who visit your site. The email checks protect people who receive mail claiming to be you, which includes customers who have not opened your site at all, and that’s why the scorer takes more points off for a missing DMARC record than for a missing CSP header: the harm from the first one lands on someone else.

A check that couldn’t be measured earns nothing and costs nothing

Each check returns one of three outcomes: pass, fail or not applicable. Not applicable covers the cases where the scanner asked and got no usable answer, such as a DNS query that timed out or came back SERVFAIL (Server Failure), or a TLS handshake that didn’t complete. The scorer drops those checks from both the numerator and the denominator and computes the score on the checks that did answer.

The line the scanner draws is between “couldn’t determine” and “determined absent”. If the TXT (Text) lookup for your domain succeeded and came back with no v=spf1 record, that’s a proven absence and the SPF checks fail at full weight. If the lookup itself failed, the scorer leaves the SPF checks out, because it shouldn’t charge a domain the same for a dropped packet as for a missing record.

The same logic decides what “graded” means in the census. The checks ran to completion on 329,604,717 domains, 91.2% of the 361,301,790 names in the census that exist. If a domain resolves and claims a website but didn’t respond, the census holds it as unreachable, since it didn’t show the surface it would have been graded on. When the nameserver lookup comes back definitively empty and nothing else resolves, the domain is dead, and a dead domain grades F: there’s nothing to check, and there’s nothing stopping anyone sending mail as it either.

One failure can hold you at C whatever else you fix

Some failures carry the scorer’s critical severity, and any unresolved one of those caps the score at 79, the top of the C band. On email, the cap comes from no DMARC record, no SPF record, two or more SPF records, an SPF record ending +all, and an SPF record that needs more than 10 DNS lookups (receivers treat the last three as a permanent error or an open door). On the web, it comes from a site that answers on port 80 and not on port 443, a TLS endpoint that won’t complete a 1.2 or 1.3 handshake, and a certificate that has expired, is not yet valid, names a different host, expires within 7 days or is signed with MD5.

This is the rule that catches the most people. A domain with valid TLS, HSTS, a full set of headers, CAA and DNSSEC, and no _dmarc record, cannot grade above C. The points it earned still count; the cap sits on top of them until you publish one TXT record.

A p=none policy isn’t critical; it earns a fraction of the DMARC weight and leaves the cap off. Publishing any valid DMARC record removes the cap, and moving to p=quarantine or p=reject earns the rest of the points. The DMARC record, tag by tag shows what each value does to a receiver.

What is a good domain security score?

Read your letter against the curve. Of the 332,492,319 domains that carry a grade in the census, which includes the dead ones, 87,562 are A+ (0.03%), 613,481 are A (0.18%), 7,227,347 are B (2.2%), 25,913,239 are C (7.8%), 51,583,703 are D (15.5%) and 247,066,987 are F (74.3%).

So a C sits above the largest band, the 74.3% at F, and above the 15.5% at D. Whether that’s good enough depends on what the domain sends. If it sends invoices, password resets or anything a customer would act on, a C usually means one of the capping conditions above is still open or DMARC is sitting at p=none, and either of those is a quick fix.

A is rare on the census because 90 leaves room for only ten points of failure across every surface, and A+ leaves five. Domains land in those bands when someone has kept going down the whole list after fixing the loudest item.

The highest-weight change you can make today

Two checks carry 8 points each, the SPF record and the DMARC policy, and a missing record on either one triggers the cap. If your result shows no DMARC record, publish one, even at p=none with a reporting address, and the cap comes off in the time it takes DNS to update. Read the reports for a few weeks, move the policy to quarantine and then to reject, and the check earns its full 8.

If DMARC is already enforcing, the next 8 is SPF: one valid record, with a qualifier on the all mechanism that matches your DMARC policy. SPF: what your record authorises covers the ~all and -all decision. After that, the table above is your priority list, largest weight first, and the nine informational checks last, because they earn nothing.

Run the free scan on your domain and read the weights beside the letter, then fix the heaviest failing check first.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.