Email domain health score and DMARC report analyzer
Enter a domain to get a score out of 100 with an A-F grade, a fix-first list and a breakdown of every check: SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and name servers, plus BIMI, CAA, DNSSEC and Microsoft 365 hints. Then drop DMARC aggregate reports or .eml messages on the page to analyse them locally.
1. Score a domain
Only DNS names (for example _dmarc.example.com) are sent to Cloudflare public DNS after you press the button. DKIM selectors cannot be listed from DNS: about 23 common ones are tried (including selector1 and selector2 for Microsoft 365, google, default, s1, s2 and k1), and a real message reveals the true selector in its DKIM-Signature s= tag. No domain is stored, logged or added to analytics by Cloudek.
How the score is worked out
The score is the points earned divided by the points that could be checked, as a percentage. The weights below add up to 100 and never change between runs, so the same DNS answers always give the same score. A, 90 or more; B, 75; C, 60; D, 40; F, below 40.
| Check | Points | What earns them |
|---|---|---|
| DMARC | 30 | Valid record 10, enforcing policy (reject 12, quarantine 8, none 2), pct=100 3, rua= reports 5 |
| SPF | 25 | One record 6, ending -all 7 (~all 5), 10 lookups or fewer 6, 2 void lookups or fewer 3, no ptr 3 |
| DKIM | 15 | A key at a common selector 10, 2048-bit key or stronger 5 |
| MX | 10 | MX or Null MX published 7, no mix of known mail providers 3 |
| MTA-STS | 10 | A valid policy TXT record |
| TLS-RPT | 5 | A TLS-RPT record with rua= |
| Domain and name servers | 5 | The domain exists in DNS |
| BIMI, CAA, DNSSEC, Microsoft 365 hints | 0 | Shown for information only; never scored |
Unknown is not pass and not fail. When a check cannot be completed (a lookup fails, or no DKIM key is found at the common selectors, which does not prove DKIM is missing) it is shown as "could not check", left out of both the points earned and the points possible, and the confidence line reports how much of the weight was checked.
Not included. The score is about email authentication and DNS configuration, not a guarantee of inbox placement. Blocklist checks are not part of this score; check them separately with the IP address lookup and blocklist check. The MTA-STS policy file and its mode cannot be read from a browser, so the mode is shown as could not check.
2. Analyse DMARC reports and emails
Questions about the score
Does a high score mean my email will reach the inbox?
No. The score only looks at published DNS records for authentication. Inbox placement also depends on sender reputation, content, sending volume and the receiving provider. Blocklist checks are not part of this score; check your mail server IPs against blocklists separately.
Why does DKIM say "could not check"?
Only the sending service knows the DKIM selector name, and DNS cannot list selectors. If none of the common ones returns a key, this page cannot tell whether DKIM is missing or uses a custom selector, so it leaves DKIM out of the score instead of marking it as a failure. Add your selector in the extra selectors box, or read the s= tag in a real message.
Are the suggested records safe to publish?
Treat them as starting points. The page cannot see every service that sends mail for you, so a suggested SPF or DMARC record may be incomplete. Check each value with your mail providers and start DMARC at p=none if you have not reviewed your reports.
What is sent where?
Only DNS names, such as _dmarc.example.com, go from your browser to Cloudflare public DNS after you press the button. The domain is not sent to Cloudek servers, stored or added to analytics.
DMARC compliance here works by upload: this page never reads a mailbox. Failure (forensic, ruf) reports can contain message content, so they stay in the browser and are not offered to AI. The .eml DKIM check is a second opinion; the receiving server's Authentication-Results is authoritative. The score is a rule-based guide to authentication and DNS configuration, not a deliverability guarantee, and blocklist checks are not part of it yet.