Strong
The completed check found the expected control in a strong configuration.
TRANSPARENT METHODOLOGY
How the grading works
Every grade follows a fixed rule based on publicly observable evidence at the assessment time. A grade is not a certification or guarantee.
Improvement recommended
A useful control exists, but it is not yet at the strongest assessed setting or includes a warning.
Attention required
A material protection is missing, invalid, duplicated or has a confirmed weakness.
Not verified
The available evidence was inconclusive. This is not treated as a confirmed failure.
Overall grade
- If any completed check receives C, the overall grade is C.
- If every check receives A, the overall grade is A.
- If there is no C but at least one B or Not verified result, the overall grade is B.
- If every check is Not verified, the overall result is Not verified.
The overall grade is deliberately conservative: a strong control does not cancel out a confirmed weakness elsewhere.
Individual check criteria
| Check | A — Strong | B — Improve | C — Attention | ? — Not verified |
|---|---|---|---|---|
| MX | Usable receiving routes, or an intentional Null MX. | Not used. | No published MX for a domain that has not declared Null MX. | The DNS lookup could not be completed. |
| SPF | One policy ending in -all. | One policy ending in ~all. | Missing, duplicated, or no clear restrictive ending. | The DNS lookup could not be completed. |
| DMARC | One policy with p=reject. | One policy with p=quarantine. | Missing, duplicated, incomplete or monitoring-only p=none. | The DNS lookup could not be completed. |
| DKIM | A public key is found for a tested selector. | Not used. | A user-supplied selector has no public key. | No key is found under common selectors, the selector is unknown, or lookup fails. |
| MTA-STS | Valid DNS and HTTPS policy in enforce mode. | Valid policy in testing mode. | Missing, duplicated, invalid, unavailable, or mode is none. | The lookup could not be completed. |
| TLS-RPT | One valid policy with a valid reporting destination. | No policy is published. | Duplicated or invalid policy. | The lookup could not be completed. |
| SMTP STARTTLS | Every tested reachable MX negotiates TLS with a valid certificate and no warning. | TLS works, but a warning or unreachable server prevents an A. | A reachable server has a confirmed STARTTLS or certificate failure. | No server could be reached from the assessment environment, or there is no receiving server to test. |
Important limitations
The assessment examines public DNS, a bounded selection of DKIM selectors, the published MTA-STS policy and externally reachable MX servers. Results can be affected by temporary outages, network restrictions, DNS propagation and information that is not publicly discoverable. Always review the technical evidence and recommendations alongside the letter grade.