What Is the Domain Scorecard?
The DNSBil Domain Scorecard is a free tool that measures the security and infrastructure health of a domain in a single scan. It runs more than twenty checks across email (SPF, DKIM, DMARC, MTA-STS), DNS infrastructure (name servers, diversity, delegation), protection and reputation (DNSSEC, CAA, blocklists) and web security (HTTPS, HSTS, security headers), then gives a score out of 100 and a grade from A+ to F.
For every gap it explains what to do and, in most cases, offers a ready-made record (for example the _dmarc TXT record) you can copy into your DNS panel. After fixing your domain you can rescan from the same page and see the improvement.
How Is the Grade Calculated?
The grade is a weighted average of four sections. Each check is worth points according to its importance; for example a domain with a DMARC policy of p=reject earns full marks while p=none earns only partial credit.
| Section | Weight | What is checked |
|---|
| Email Security | 35% | SPF, DMARC, DKIM, MX, MTA-STS, TLS-RPT |
| DNS Infrastructure | 25% | Name server count and responses, network diversity, SOA sync, delegation, open recursion, IPv6 |
| Protection & Reputation | 20% | DNSSEC, CAA, domain blocklists, dangling CNAME |
| Web & HTTPS | 20% | Certificate and expiry, TLS version, HTTP→HTTPS redirect, HSTS, security headers, www |
Grades: A+ 95 and above, A 88, B 75, C 60, D 45, below that F. Sections that do not apply to a domain (for example Web & HTTPS for a domain without a website) are left out of the score. Critical findings such as an expired certificate, +all in SPF, a broken DNSSEC chain, a single name server or a blocklist entry cap the grade: such domains cannot score highly even if everything else is perfect.
Frequently Asked Questions
Which checks does the scorecard run?
Email: SPF, DMARC, DKIM, MX, MTA-STS and TLS-RPT. DNS: name server count, responsiveness, diversity, SOA sync, delegation consistency, open recursion and IPv6. Protection: DNSSEC, CAA, domain blocklists and dangling CNAME. Web: HTTPS certificate, certificate expiry, TLS version, HTTP→HTTPS redirect, HSTS and security headers.
Can I scan someone else's domain?
Yes. The scorecard relies on public DNS data and a single ordinary HTTPS request to the site's home page; no penetration testing or probing is done. Still, we recommend using it for your own domains or your clients'.
Why does DKIM say "not detected"?
DKIM keys are published under a selector name and the list of selectors is not public. The scorecard tries the common ones; if none is found a custom selector may be in use, so the check is left out of the score and you are not penalised.
I fixed it but my grade did not change. Why?
Results are cached for 15 minutes and DNS changes take up to the record's TTL to propagate. Wait a few minutes and press "Rescan". The change from your previous scans is shown on the result card.
Do I have to get an A+?
No. Many large sites do not get full marks on every check either. The goal is not perfection but seeing real risks: findings marked red and tagged "Critical" should come first.
How do I add the badge?
Paste the HTML or Markdown code from the "Add the badge to your site" section that appears after a scan into your site or README. The badge shows your domain's current grade.