Domain Rating Explained

Domain Rating: How the 0–100 Score Is Calculated

TL;DR: a weighted score out of 100, from the latest check results plus observed DMARC pass rate over a rolling window: 90 days by default. From v0.2.0 each organization can set it to 30, 60, 90 or 180 days under Settings → General ("Rating period"); the failing-messages count, "ready to enforce" and the Senders list's default range use the same period.

The formula

Factor	Weight
DMARC policy strength	25
DMARC pass rate (observed)	20
SPF	10
DKIM	10
MX	10
STARTTLS	10
MTA-STS	5
DANE	5
TLS-RPT	5

90+ is an A, 80+ a B, 70+ a C, 60+ a D, below that an F.

Traffic from sources explicitly reviewed and marked "blocked" is excluded from the pass rate — confirmed abuse shouldn't drag a domain's score down forever.

This weighting is a first pass, checked against real domains during development but not treated as final — expect it to get tuned as more domains run through it.

Worked example

A domain with p=reject (full DMARC policy strength: 25/25), a 96% observed pass rate (19/20), and clean SPF/DKIM/MX/STARTTLS (40/40) but no MTA-STS/DANE/TLS-RPT (0/15) lands at 84 — a B, held back entirely by the optional hardening layers, not by anything broken.

Where you'll see this

The domain list and each domain's detail page. The policy builder uses the same pass-rate signal to decide when it's actually safe to recommend tightening p=.

Trend (from v0.2.0)

Next to the grade, each domain shows whether its DMARC pass rate is trending up, stable or trending down: the last 7 days against the 28 before. It only counts as a trend when the change is:

• real, not chance: a statistical test that weighs message counts, so 2 failures out of 28 messages count for much less than 200 out of 2,800. For quiet domains it uses an exact test, which stays reliable with only a handful of messages;
• at least 2 percentage points;
• more than a swing of one or two messages: at least 3 more failed messages than usual for that domain;
• lasting: on at least 3 different days in the last week.

A quiet domain with one bad day stays stable; the same failures on several days trend down. A domain that already sees a few failures every week (from forwarding, say) isn't flagged for those. With fewer than 10 messages in the last week it says "not enough mail yet". A domain trending down also gets an Action queue item. Trends are recalculated every 6 hours.

See also

• DMARC Subdomain Policy Inheritance
• SPF Conditional Mode

---

← Core Concepts · Home