Email Security Score Calculator

Score email security from SPF, DKIM and DMARC alignment plus MTA-STS, TLS reporting, filtering and impersonation controls.

About Email Security Score Calculator

SPF and DKIM prove that mail is authorised; DMARC is what tells the receiving world to act when it is not, which is why a p=none record earns almost no spoofing credit however good the underlying records are. Inbound controls are scored separately and weighted heavily, because authentication does nothing against a phish sent from a lookalike domain that passes its own SPF and DKIM perfectly. The alignment figure is the practical gate on enforcement. Publishing DMARC at p=none and stopping there is the most common email-security outcome, and it leaves your domain as spoofable as it was on day one.

Formulas

Email Security Score

authentication: SPF, DKIM and DMARC configuration strength
spoofingProtection: Credit only for quarantine or reject — p=none protects nothing
inboundFiltering: Sandboxing, retraction and impersonation controls
transportSecurity: MTA-STS enforcement and TLS reporting

Why p=none scores near zero

Outbound spoofing is only prevented when DMARC is at quarantine or reject and applied to 100% of mail; p=none provides reporting visibility only.

p=none: Monitoring policy — receivers take no action
pct: Share of mail the policy applies to

Worked example

With the default values below, Email Security Score Calculator returns Email Security Score of 48.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

SPF recordone of None — 0, Present, ends in ?all or +all — 1, Present, ends in ~all — 3, Present, ends in -all — 4: Present, ends in ~all — 3
DKIM signingone of Not signing — 0, Signing with a 1024-bit key — 2, Signing with a 2048-bit key — 4, Signing with 2048-bit and rotated keys — 4.5: Signing with a 1024-bit key — 2
DMARC policyone of No DMARC record — 0, p=none — 2, p=quarantine — 3.5, p=reject — 5: p=none — 2
DMARC policy applied toaccepts 0–100 % of mail: 100 % of mail
Legitimate mail passing DMARC alignmentaccepts 0–100 %: 88 %
MTA-STS and TLS-RPTone of Neither — 0, TLS-RPT only — 0.5, MTA-STS in testing mode — 1, MTA-STS in enforce mode — 2: MTA-STS in testing mode — 1
Inbound filtering capabilityone of Basic anti-spam only — 1, Anti-spam with URL rewriting — 2, Sandboxing of attachments and links — 3, Sandboxing plus post-delivery retraction — 4: Sandboxing of attachments and links — 3
Impersonation and BEC controlsone of None — 0, Display-name and lookalike-domain rules — 2, Plus external-sender banners and payment-change workflow — 3: Display-name and lookalike-domain rules — 2

Results

Email Security Score: 48.0 / 100
Rating: D — Weak
Spoofing Protection: 15.0%
Authentication Strength: 51.9 / 100
Ready for p=reject: No — too much legitimate mail is unaligned; fix third-party senders before enforcing
Next Step: Move DMARC to p=reject once alignment passes 99%

Step by step

1Values used
2Email Security Score
3Why p=none scores near zero
4Email Security Score= 48.0 / 100
5Rating= D — Weak
6Spoofing Protection= 15.0
7Authentication Strength= 51.9 / 100
8Ready for p=reject= No — too much legitimate mail is unaligned; fix third-party senders before enforcing
9Next Step= Move DMARC to p=reject once alignment passes 99%

Assumptions and limits

The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Email Security Score calculated?

score = 0.34×authentication + 0.26×spoofingProtection + 0.30×inboundFiltering + 0.10×transportSecurity, where authentication combines SPF strictness, DKIM key strength and the DMARC policy applied to your mail. SPF and DKIM prove that mail is authorised; DMARC is what tells the receiving world to act when it is not, which is why a p=none record earns almost no spoofing credit however good the underlying records are. Inbound controls are scored separately and weighted heavily, because authentication does nothing against a phish sent from a lookalike domain that passes its own SPF and DKIM perfectly. The alignment figure is the practical gate on enforcement.

Why does Email Security Score matter?

Publishing DMARC at p=none and stopping there is the most common email-security outcome, and it leaves your domain as spoofable as it was on day one.

What values do I need to enter?

This calculator takes 8 inputs: SPF record, DKIM signing, DMARC policy, DMARC policy applied to, Legitimate mail passing DMARC alignment, MTA-STS and TLS-RPT, Inbound filtering capability, Impersonation and BEC controls. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is 99% alignment needed before p=reject?

Because the remaining percent is legitimate mail — usually marketing platforms, ticketing systems and payroll — that will silently vanish. Aggregate DMARC reports identify those senders so they can be brought into alignment first.

Does DMARC stop business email compromise?

No. Most BEC arrives from a lookalike domain or a compromised third-party mailbox, both of which authenticate correctly. DMARC stops the exact-domain spoof; impersonation rules, external-sender banners and a payment-change verification workflow address the rest.