Domain Trust Check

What is a Security Grade?

A Security Grade is a single letter (A+ through F) that summarises how well a domain is protected across up to 16 outside-in checks of its email, web, DNS and registration security. It is designed to do the work that fifteen separate protocol checkers can't: answer the question “is my domain secure?” in one glance.

Under the hood the grade rolls up checks across email authentication (DMARC, SPF), transport security (SSL, MTA-STS, TLS-RPT), DNS integrity (DNSSEC, CAA), and domain registration hygiene. You see the grade. Below it, you see the specific improvements that would raise it.

What this tool checks

• DMARC: record presence, policy (none / quarantine / reject), subdomain policy, pct, and rua reporting.
• SPF: record presence, all-qualifier (-all / ~all), and DNS lookup count.
• SSL/TLS: certificate validity and days remaining before expiry.
• MTA-STS: whether it is in force: one valid record at _mta-sts.domain and a policy file that sending servers can fetch and use.
• TLS-RPT: whether one record at _smtp._tls.domain gives sending servers an address for their reports.
• DNSSEC: whether the zone is cryptographically signed.
• CAA: whether a record restricts which certificate authorities can issue for the domain.
• Domain registration: RDAP lookup for registration status, transfer lock, and days until expiry.

DKIM is not on that list, and it is worth saying why. A DKIM key is published under a selector name chosen by whoever sends your mail, and nothing in DNS lists those names. The only way to look is to guess selectors and see which ones answer. That is fine for a report you read yourself. It is not fine for a grade, because a domain signing under a name we did not try would be marked down for a fault it does not have. To try the common selectors, plus any you name, use the DKIM Checker.

How the grade is worked out

Every check above feeds the grade, and they are weighted so that no single layer can carry it. A domain that gets email authentication right, with DMARC at reject on the domain and its subdomains and a valid certificate, earns a B on its own. The A grades also need most of the transport and DNS layer: MTA-STS, TLS-RPT, DNSSEC, certificate issuance protection (CAA) and a registrar transfer lock. Domain expiry is shown for information and does not count against the grade until the registration has lapsed.

What the grade does not measure is popularity. It says nothing about how much traffic a domain gets, how many sites link to it, or how long it has existed. It reads your live DNS, certificate and registration configuration and asks whether that configuration would stop someone spoofing your email, obtaining a certificate in your name, or tampering with your DNS answers. It is also a point-in-time reading: it describes the configuration in front of it at the moment you run the check, and nothing beyond that.

How to check domain security

If you are auditing a domain for the first time, work through it in this order. It takes a few minutes per domain and it stops you fixing cosmetic problems ahead of structural ones.

1. Check the registered domain itself. Enter it on its own, with no protocol and no www. That is the name an attacker forges, and it is the name your DMARC, SPF and DKIM policies are published against.
2. Read the failing rows before the headline figure. The grade tells you where you stand; the individual checks tell you what to do. Open the full list and work down it rather than inferring the problem from a letter.
3. Fix the basics before anything else. SPF, DMARC with aggregate reporting, and a valid certificate come first. Hardening such as MTA-STS or DNSSEC protects little while anyone can still send email as you.
4. Take the email authentication chain in order. Publish SPF and DKIM, get DMARC aggregate reporting flowing, and only then tighten the policy towards enforcement. Moving to reject before you can see who is sending on your behalf is how legitimate mail gets blocked.
5. Repeat for every domain on the account. Parked domains, redirect domains and retired brands are the ones attackers reach for, precisely because nobody is watching them. A domain that sends no mail still needs a DMARC record saying so.
6. Re-run it after each change, then on a schedule. A check describes configuration as it stands. Certificates get reissued, DNS records get edited, registrar settings get changed by someone who was not in the room. What passes today can drift out of compliance without anyone touching the security work itself.

Stated in DNS terms, a domain security policy is four things: a DMARC record at an enforcing policy so receivers act on spoofed mail, an SPF record whose qualifier actually rejects unlisted senders instead of merely marking them, an MTA-STS policy published and set to enforce so mail cannot be downgraded out of TLS in transit, and a CAA record naming the certificate authorities permitted to issue for you. The rest of the checks on this page support those four.

Domain trust vs SEO domain authority

“Domain trust” is used for three unrelated things, so it is worth saying plainly which one this page is. Several SEO platforms publish a domain trust or domain authority metric derived from a site’s backlink profile, as a proxy for how favourably search engines treat it. ShieldMarc does not calculate anything of that kind. The grade here has no bearing on search rankings and should not be compared with one.

The same phrase appears in Windows administration, where verifying a domain trust means testing the trust relationship between two Active Directory domains. That is an internal directory task, carried out against a domain controller, and this tool has nothing to say about it.

This page is the third meaning: a security reading of a domain from the outside. It asks whether your public DNS, mail authentication and certificate configuration would stop an outsider sending email as you, obtaining a certificate in your name, or forging your DNS answers. Everything it reports is observable by anyone on the internet, which is exactly why it is worth knowing what it says about you.

For MSPs: a language your clients understand

Clients don't want to hear about SPF qualifiers or TLS reporting. They want to know whether their domain is safe. A letter grade from an external audit is a language the whole room understands, from the board to the helpdesk. Run a check in a meeting, show the grade, and the conversation shifts from “why do I need this?” to “how do we move from C to A?”

Need continuous monitoring?

This free tool is a point-in-time scan. Certificates expire, DNS records drift, DMARC policies get relaxed. With continuous monitoring in ShieldMarc, the grade is recalculated daily, you are emailed when a monitored DMARC policy changes or a certificate nears expiry, and you can export reports with your own branding (white-label on the MSP plan). Start a free trial for 30 days free.