Live DNS check · same engine as the full SecLens score

Email security score

SecLens scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product. The number is the sum of published, enforced SPF, DMARC, DKIM, DNSSEC, MTA-STS, DANE, and TLS-RPT against documented weights. Enter a domain to see the score and every gap.

Public assessments are free. No account. The full 0–100 stack is included below the focused result.

0.34%
of mail-enabled Top-1M domains deploy the full defensive stack
70.9%
remain spoofable

Figures from the July 2026 Top-1M study.

FAQ

Common questions

How is the email security score calculated?

On the mail profile the seven checks sum to 100: DMARC 25, SPF 20, MTA-STS 15, DKIM 10, DNSSEC 10, DANE 10, TLS-RPT 10. Domains that send no mail use a Null MX profile instead. The rules are on /methodology/.

Is this a vendor grade or a live check?

It is a live check. SecLens queries public DNS (and fetches the MTA-STS policy file when advertised) and scores what is published now. It is the same POST /api/assessment used on the homepage.

What is a good score?

Excellent is 90–100, good 70–89, fair 40–69, poor below 40. In the July 2026 Top-1M study, 0.34% of mail-enabled domains met the full defensive stack. The score is a map of gaps, not a marketing badge.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.