How the grade is built: 34 checks, 100 points, and the 40 that email carries

Your grade is a score out of 100, mapped to a letter. Twenty-five checks earn points, another nine are reported and earn nothing, and 40 of the 100 points sit on the email surface. A C means the domain scored between 70 and 79, which puts it above the F band that holds 74.2% of the 316,600,902 domains carrying a grade in the September 2026 census.

If you’ve got a result open while you read this, spend less time on the letter and more on the weights underneath it, because the weights are what show you which check to change.

The bands the score falls into

The scorer produces a whole number from 0 to 100 and reads it against six fixed cut-offs. A+ needs 95 or more, A needs 90, B needs 80, C needs 70, D needs 60, and anything below 60 is F. The cut-offs haven’t changed since the grading started, so a B on one domain means the same as a B on another.

The letter is coarse by design. A domain at 79 and a domain at 70 both show C, and the gap between them is a whole check’s worth of points. When you compare two results, compare the scores and the failing checks, and treat the letter as the name of the band.

Thirty-four checks, and the nine that can’t move the grade

The registry lists 34 checks in five groups: Email Security, TLS & Certificates, Web Security, DNS Security and Infrastructure. Twenty-five of them are scored. The other nine are informational. They still run and show in your result as pass or fail, and none of them carries points.

Three of the nine are TLS checks: tls-compression, ocsp-stapling and secure-renegotiation. They can’t be measured reliably from where the scanner sits, so they’re reported and left out of the sum. A domain can show all three as failing and still grade A+ at 100. If you fix one of them and the score doesn’t move, nothing is wrong with the scan; the check was never in the score to begin with.

The remaining six are the three cross-origin headers (coop-header, corp-header and coep-header), ipv6-support, and the two Infrastructure checks, cdn-waf-detection and hosting-provider. Those last two are fingerprints of what sits in front of the site, and there’s no fail state to score.

Where the 100 points sit

Each scored check has a weight, and the weights add up to 100 across the five groups.

A check doesn’t earn its weight all or nothing. Each one reports a score against its own maximum, and the scorer takes that fraction of the weight. DMARC policy is the clearest case: p=reject earns the full 8, p=quarantine earns about half of it, and p=none earns about a quarter. A weaker sp= policy for subdomains and a pct= value below 100 both pull the fraction down further.

The final score is the weight earned divided by the weight that applied to your domain, scaled to 100. The profile rule in the next section decides which weights apply to a given domain.

Why email is the biggest block

There are two reasons for the 40. The first is reach: the census finds an MX record on 173,282,307 of the 316,600,902 graded domains (54.7%), so for more than half of the graded internet, mail is a live surface and the three email-infrastructure checks (DKIM, MX records and reverse DNS) apply.

The second is that SPF and DMARC are scored whether or not the domain accepts mail, because forging a sender address needs nothing from the domain except a missing policy. Can someone spoof my domain? walks through how that forgery is sent.

The profile rule handles the rest. If your domain has no MX record, the scorer marks DKIM, MX records and reverse DNS not applicable and takes their 14 points out of the denominator. It then rescales the remaining weight so the score is still out of 100. A web-only domain is graded on what it presents, and it doesn’t lose points for a mail system it doesn’t run.

Weight is also a statement about who gets hurt. The web checks protect people who visit your site. The email checks protect people who receive mail claiming to be you, which includes customers who have not opened your site at all, and that’s why the scorer takes more points off for a missing DMARC record than for a missing CSP header: the harm from the first one lands on someone else.

A check that couldn’t be measured earns nothing and costs nothing

Each check returns one of three outcomes: pass, fail or not applicable. Not applicable covers the cases where the scanner asked and got no usable answer, such as a DNS query that timed out or came back SERVFAIL, or a TLS handshake that didn’t complete. The scorer drops those checks from both the numerator and the denominator and computes the score on the checks that did answer.

The line the scanner draws is between “couldn’t determine” and “determined absent”. If the TXT lookup for your domain succeeded and came back with no v=spf1 record, that’s a proven absence and the SPF checks fail at full weight. If the lookup itself failed, the scorer leaves the SPF checks out, because it shouldn’t charge a domain the same for a dropped packet as for a missing record.

The same logic decides what “graded” means in the census. The checks ran to completion on 315,211,826 domains, 90.7% of everything scanned. If a domain resolves and claims a website but didn’t respond, the census holds it as unreachable, since it didn’t show the surface it would have been graded on. When there are no nameservers at all, the domain is dead, and a dead domain grades F: there’s nothing to check, and there’s nothing stopping anyone sending mail as it either.

One failure can hold you at C whatever else you fix

Some failures carry the scorer’s critical severity, and any unresolved one of those caps the score at 79, the top of the C band. Four conditions trigger it: no DMARC record at all, two or more SPF records (receivers treat that as a permanent error), a site that answers on port 80 and not on port 443, and a TLS endpoint that won’t complete a 1.2 or 1.3 handshake.

This is the rule that catches the most people. A domain with valid TLS, HSTS, a full set of headers, CAA and DNSSEC, and no _dmarc record, cannot grade above C. The points it earned still count; the cap sits on top of them until you publish one TXT record.

A p=none policy isn’t critical; it earns a fraction of the DMARC weight and leaves the cap off. Publishing any valid DMARC record removes the cap, and moving to p=quarantine or p=reject earns the rest of the points. The DMARC record, tag by tag shows what each value does to a receiver.

What is a good domain security score?

Read your letter against the curve. Of the 316,600,902 domains that carry a grade in the September 2026 census, which includes the dead ones, 80,995 are A+ (0.03%), 546,149 are A (0.17%), 6,404,429 are B (2.0%), 24,626,081 are C (7.8%), 49,987,773 are D (15.8%) and 234,955,475 are F (74.2%).

So a C sits above the largest band, the 74.2% at F, and above the 15.8% at D. Whether that’s good enough depends on what the domain sends. If it sends invoices, password resets or anything a customer would act on, a C usually means one of the four capping conditions is still open or DMARC is sitting at p=none, and either of those is a quick fix.

A is rare on the census because 90 leaves room for only ten points of failure across every surface, and A+ leaves five. Domains land in those bands when someone has kept going down the whole list after fixing the loudest item.

The highest-weight change you can make today

Two checks carry 8 points each, the SPF record and the DMARC policy, and one of them also controls the cap. If your result shows no DMARC record, publish one, even at p=none with a reporting address, and the cap comes off in the time it takes DNS to update. Read the reports for a few weeks, move the policy to quarantine and then to reject, and the check earns its full 8.

If DMARC is already enforcing, the next 8 is SPF: one valid record, with a qualifier on the all mechanism that matches your DMARC policy. SPF: what your record authorises covers the ~all and -all decision. After that, the table above is your priority list, largest weight first, and the nine informational checks last, because they earn nothing.

Run the free scan on your domain and read the weights beside the letter, then fix the heaviest failing check first.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.