# Email security

> Check a domain's SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, BIMI and TLS-RPT records and see how each one adds to the A+ to F grade.

Source: https://docs.vigilbase.com/tools/email-security

The Email Security Analyzer looks up a domain's public email authentication records and grades them A+ to F. It reads DNS only and needs no sign-up. Run it at [vigilbase.com/tools/email-security](https://vigilbase.com/tools/email-security).

## Run a check

:::steps
1. **Enter a domain**, for example `example.com`.
2. **Complete the security check** and run the scan.
3. **Read the result.** Each record shows what was found, a status and a recommendation.
4. **Email the report, optionally.** Enter a work email under the result. See [Report by email](https://docs.vigilbase.com/tools#report-by-email).
:::

Reserved names such as `.test`, `.example`, `.local` and `.internal`, and IP addresses, are refused.

## What it checks

| Record | What the check reads | Weight |
| --- | --- | --- |
| DMARC | The TXT record at `_dmarc.<domain>`. With no record there, the organisational domain's policy applies, as receivers do. | 25 |
| SPF | The `v=spf1` TXT record at the domain. | 20 |
| DKIM | TXT records at 14 common selectors under `_domainkey`: `google`, `selector1`, `selector2`, `default`, `dkim`, `mail`, `k1`, `k2`, `s1`, `s2`, `sig1`, `email`, `smtp` and `postmark`. | 15 |
| MX | The domain's MX records, and the mail provider they point to. | 10 |
| DNSSEC | Whether a validating resolver authenticates the domain's answers. | 10 |
| MTA-STS | The `_mta-sts` TXT record and the policy file at `https://mta-sts.<domain>/.well-known/mta-sts.txt`. | 10 |
| BIMI | The BIMI record and its logo and certificate URLs. | 5 |
| TLS-RPT | The TLS reporting record and its `rua` address. | 5 |

Each record scores 0 to 100. 80 or more is good, 50 to 79 is a warning and below 50 is bad. A missing record scores 0, including the optional BIMI and TLS-RPT records.

DKIM selectors are not published anywhere, so a domain whose keys use another selector shows DKIM as missing even if it signs mail.

## How each record is scored

| Record | Points lost |
| --- | --- |
| SPF | `+all` 50, `?all` 30, `~all` 10, more than 10 lookup terms 20 (8 to 10 cost 10), `ptr` 10. More than one SPF record scores 30. |
| DMARC | `p=none` 40, `p=quarantine` 10, `pct` below 100 15, no `rua` 10, a subdomain policy weaker than the main one 5. |
| DKIM | A key at any selector scores 100. None scores 0. |
| MX | Only one MX record 10, an invalid exchange 30, an MX pointing at an IP address 20. |
| DNSSEC | Validated 100, not enabled 0, could not be verified 50. |
| MTA-STS | `mode: enforce` 100, `testing` 80, `none` 50; a record whose policy file cannot be fetched scores 40. |
| BIMI | No logo URL (`l=`) 50, no mark certificate (`a=`) 20. |
| TLS-RPT | No reporting address 50. |

The lookup count for SPF covers `include:`, `a:`, `mx:`, `ptr:` and `redirect=` in the record itself; it does not follow includes, so the real total can be higher.

## How the grade is calculated

The weighted record scores add up to a score out of 100.

| Grade | Score |
| --- | --- |
| A+ | 90 or more |
| A | 80-89 |
| B | 65-79 |
| C | 50-64 |
| D | 35-49 |
| F | Below 35 |

A missing DMARC record is a critical finding; missing SPF or DKIM is high, missing MX, DNSSEC or MTA-STS is medium, and missing BIMI or TLS-RPT is low.

The status is **Vulnerable** when there is a critical finding or the grade is F, **Warnings** for a high-severity finding or grade C or D, and **Secure** otherwise.

## Fix common findings

:::accordion
### DMARC not configured
Publish a TXT record at `_dmarc.<domain>`, starting with `v=DMARC1; p=none; rua=mailto:dmarc@example.com` to collect reports. The [DMARC generator](https://docs.vigilbase.com/tools/record-generators) builds one.

### DMARC policy is none
Once your reports show every legitimate sender passing, move to `p=quarantine`, then `p=reject`.

### No SPF record, or more than one
Publish exactly one `v=spf1` TXT record that lists every service that sends your mail and ends in `~all` or `-all`. Merge duplicates into one record.

### SPF uses ~all or +all
Replace `+all` at once. Change `~all` to `-all` when every sender is listed.

### DKIM not found
Turn on DKIM signing with your mail provider and publish the key it gives you. If your provider uses a selector outside the list above, the check cannot find it; confirm DKIM from a message header (`DKIM-Signature: ... s=<selector>`) or your provider's console instead.

### MTA-STS missing or in testing
Publish the policy file first, then the `_mta-sts` TXT record. Move from `testing` to `enforce` once TLS-RPT reports show no failures.
:::

## Focused checkers

The [email record checkers](https://docs.vigilbase.com/tools/email-checkers) run this same scan and explain one record in depth.

## Run it from code

The check is on the anonymous [Agent API](https://docs.vigilbase.com/tools/developers/agent-api) and in the [CLI](https://docs.vigilbase.com/tools/cli/commands):

```bash
npx @vigilbase/cli email example.com
```