Your Email Health Score is a single number from 0 to 100, with a letter grade, that answers one question: how protected is this domain’s email — and can it prove it? It is ToolTrusted’s independent, measured-only read of your domain’s email posture, taken from public DNS in about 30 seconds with no setup and no access to your account. This page explains exactly how to read the number, the grade, and every part of the breakdown underneath it — so the score isn’t a mystery, it’s a to-do list. You can run a free Email Health Check on any domain and follow along.
What the score measures
The score is built from four measured dimensions — not opinions, and not inbox-placement guesses. Each is made of real records we look up live:
- Authentication — SPF, DKIM and DMARC: the records that let a receiver confirm mail really came from you.
- Infrastructure — MX, MTA-STS, TLS-RPT and DNSSEC: how your mail is routed and whether it is protected in transit.
- Security — DMARC enforcement, MTA-STS mode and BIMI: whether your anti-spoofing posture is actually turned on, not just published.
- Reputation — a live blocklist (DNSBL) check on your real mail-server IPs.
Because every dimension is a public, verifiable signal, the score is deterministic: the same records always produce the same number. There is no AI guesswork, and nothing you can’t check yourself.
What your grade means
The number always comes with a letter grade and a plain-English band, so you know how seriously to take it. Read them together — for example, “63 / C — Exposed.”
| Score | Grade | Band | What it means |
|---|---|---|---|
| 85–100 | A | Protected | Authenticated and hard to forge. Keep it there with monitoring. |
| 70–84 | B | Mostly protected | Close — but one change away from exposure. There is a live gap worth closing. |
| 50–69 | C | Exposed | Partial authentication; spoofing or spam filtering is plausible. Fix soon. |
| 30–49 | D | At risk | Core protections are missing; your domain is forgeable today. Urgent. |
| 0–29 | F | Unprotected | No meaningful defense — anyone can send as you. Start now. |
Why this score? The points ledger
ToolTrusted doesn’t just hand you a number — it shows its work. Under the score you’ll see a ledger: each gap listed as a specific “−N points,” tied to the exact record responsible. A missing DMARC record, an SPF that’s still on a soft ~all, no MTA-STS policy — each one costs a named amount, so you can see precisely what is holding the score down and by how much. The breakdown also names the dominant reason — the single dimension dragging you down most (for example, “held down by Authentication”) — so you know where to start.
How high can you go? The ceiling
Every report shows a ceiling — the score you would reach if you applied all the recommended fixes (for example, “Ceiling: 92 / A if all fixes applied”). The ceiling turns the score from a verdict into a target: it tells you whether the work in front of you is a quick two-record fix or a bigger project, and exactly what grade it unlocks. Each recommended fix shows the points it hands back, ranked so the highest-impact change is first.
How sure are we — and how you compare
The report tells you the confidence behind the number: it was measured from public DNS on a specific date, and it flags which signals are live (your reputation/blocklist status is checked in real time). Nothing is inferred or padded — if something can’t be measured from the outside, we say so rather than guess. You’ll also see a benchmark percentile — how your domain compares to the population of domains we’ve measured (for example, “beats 73% of domains”) — so the score has context, not just a value.
What to do next
- Fix the top item. Start with the highest-impact recommendation — the one returning the most points — then re-run the check to confirm the score moved. Each fix links to a plain-English guide.
- Save it and turn on monitoring. Save the report to a free workspace and ToolTrusted re-checks your domain on a schedule, remembers every change, and emails you the moment something breaks — so a silent DMARC downgrade or a new blocklisting never goes unnoticed.
- Recover, don’t just detect. When a problem appears, the report walks you toward the fix and keeps watching until the score confirms you’re back to good.
Why you can trust the number
ToolTrusted is independent — we sell no ESP, host no one’s DNS, and run no remediation service, so the score carries no vendor’s agenda. It is measured, deterministic and fully explainable: every point traces back to a record we show you. That’s the whole idea — a number you can act on because you can see exactly where it came from. Learn more about our method on the How we test page, or see the full picture on the ToolTrusted platform.