Email Security Score Calculator

score = 0.34×authentication + 0.26×spoofingProtection + 0.30×inboundFiltering + 0.10×transportSecurity, where authentication combines SPF strictness, DKIM key strength and the DMARC policy applied to your mail. SPF and DKIM prove that mail is authorised; DMARC is what tells the receiving world to act when it is not, which is why a p=none record earns almost no spoofing credit however good the underlying records are. Inbound controls are scored separately and weighted heavily, because authentication does nothing against a phish sent from a lookalike domain that passes its own SPF and DKIM perfectly. The alignment figure is the practical gate on enforcement.

Publishing DMARC at p=none and stopping there is the most common email-security outcome, and it leaves your domain as spoofable as it was on day one.

This calculator takes 8 inputs: SPF record, DKIM signing, DMARC policy, DMARC policy applied to, Legitimate mail passing DMARC alignment, MTA-STS and TLS-RPT, Inbound filtering capability, Impersonation and BEC controls. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because the remaining percent is legitimate mail — usually marketing platforms, ticketing systems and payroll — that will silently vanish. Aggregate DMARC reports identify those senders so they can be brought into alignment first.

No. Most BEC arrives from a lookalike domain or a compromised third-party mailbox, both of which authenticate correctly. DMARC stops the exact-domain spoof; impersonation rules, external-sender banners and a payment-change verification workflow address the rest.