Skip to content

Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product. The number is the sum of published, enforced SPF, DMARC, DKIM, DNSSEC, MTA-STS, DANE, and TLS-RPT against documented weights. Enter a domain to see the score and every gap.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. The same 0-100 score comes back for every checker on this site.

0.34%
of mail-enabled Top-1M domains deploy the full defensive stack
69.1%
remain spoofable

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

How is the email security score calculated?

On the mail profile the seven checks sum to 100: DMARC 25, SPF 20, MTA-STS 15, DKIM 10, DNSSEC 10, DANE 10, TLS-RPT 10. BIMI is recorded on the report and is not part of the 100. Domains that send no mail use a Null MX profile instead. The rules are on /methodology/.

Is this a vendor grade or a live check?

It is a live check. SecLens.ONE queries public DNS (and fetches the MTA-STS policy file when advertised) and scores what is published now. It is the same POST /api/assessment used on the homepage.

What is a good score?

Excellent is 90-100, good 70-89, fair 40-69, poor below 40. In the October 2026 Top-1M study, 0.34% of mail-enabled domains met the full defensive stack, the same rate as July 2026. The score is a map of gaps, not a marketing badge.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.