Full Domain Report
Everything the DNS can tell us about a domain’s email security, in one pass — with a grade that explains itself.
Try paypal.com, gov.uk or turbosec.io
How the grade works
Points are for protection, not presence
A DMARC record at p=none earns four points out of thirty, because it stops nothing. Graders that reward having a record produce domains with a record and no protection.
Optional controls cannot hurt you
No BIMI record is not a security failing — it just means no logo. MTA-STS and BIMI add points; their absence subtracts none.
Some faults set a ceiling
An enforcing policy with sp=none, an SPF record over the lookup limit, or a DKIM key left in testing mode are holes, not deductions. They cap the grade, and the cap says why.
We do not grade what we cannot see
DKIM selectors cannot be enumerated. If we find no key, DKIM drops out of the calculation rather than counting as a failure — the limitation is ours, not the domain’s.