Domain Trust Check

What is a Security Grade?

A Security Grade is a single letter (A+ through F) that summarises how well a domain is protected across every externally observable security signal. It is designed to do the work that fifteen separate protocol checkers can't: answer the question “is my domain secure?” in one glance.

Under the hood the grade (our Domain Trust Rating, or DTR) rolls up checks across email authentication (DMARC, SPF), transport security (SSL, MTA-STS, TLS-RPT), DNS integrity (DNSSEC, CAA), and domain registration hygiene. You see the grade. Below it, you see the specific improvements that would raise it.

What this tool checks

• DMARC: record presence, policy (none / quarantine / reject), subdomain policy, pct, alignment modes, and rua reporting.
• SPF: record presence, all-qualifier (-all / ~all), and DNS lookup count.
• SSL/TLS: certificate validity and days remaining before expiry.
• MTA-STS: whether a policy record exists at _mta-sts.domain.
• TLS-RPT: whether a reporting record exists at _smtp._tls.domain.
• DNSSEC: whether the zone is cryptographically signed.
• CAA: whether a record restricts which certificate authorities can issue for the domain.
• Domain registration: RDAP lookup for registration status, transfer lock, and days until expiry.

DKIM is not on that list, and it is worth saying why. A DKIM key is published under a selector name chosen by whoever sends your mail, and nothing in DNS lists those names. The only way to look is to guess selectors and see which ones answer. That is fine for a report you read yourself. It is not fine for a score, because a domain signing under a name we did not try would lose marks for a fault it does not have. To probe 20 common selectors, or one you name, use the DKIM Checker.

Score, grade and level: what each one means

Every scan returns three related figures and they answer different questions. The domain trust score is a number from 0 to 100. The grade is that same number expressed as a letter, from A+ down to F, so the result reads at a glance. The level is a maturity band: Unrated, then Foundation, Hardened, Enforced and Resilient. A domain that misses any Foundation check stays Unrated regardless of its score.

The score is built from those four levels rather than from a flat list of checks. Each level is worth 25 points, divided evenly between whichever checks apply to your domain, so a level carrying fewer checks weights each one more heavily. That is why the same fix can move the number by several points on one domain and by fewer on another.

The level behaves differently again. It is a gate, not an average: you reach a level only when every check at that level passes, and only if the level below it is already complete. A domain can hold a respectable score and still sit at Foundation, because one outstanding check is enough to keep the whole level open. Read the score as progress and the level as the threshold you have actually cleared.

What the score does not measure is popularity. It says nothing about how much traffic a domain gets, how many sites link to it, or how long it has existed. It reads your live DNS, certificate and registration configuration and asks whether that configuration would stop someone spoofing your email, obtaining a certificate in your name, or tampering with your DNS answers. It is also a point-in-time reading: it describes the configuration in front of it at the moment you run the check, and nothing beyond that.

How to check domain security

If you are auditing a domain for the first time, work through it in this order. It takes a few minutes per domain and it stops you fixing cosmetic problems ahead of structural ones.

1. Check the registered domain itself. Enter it on its own, with no protocol and no www. That is the name an attacker forges, and it is the name your DMARC, SPF and DKIM policies are published against.
2. Read the failing rows before the headline figure. The score tells you where you stand; the individual checks tell you what to do. Open the full list and work down it rather than inferring the problem from a letter.
3. Clear level 1 before anything else. The maturity level is awarded in sequence, so level 2 arrives only once every level 1 check passes. A missing SPF or DMARC record holds back every piece of hardening you have done above it.
4. Take the email authentication chain in order. Publish SPF and DKIM, get DMARC aggregate reporting flowing, and only then tighten the policy towards enforcement. Moving to reject before you can see who is sending on your behalf is how legitimate mail gets blocked.
5. Repeat for every domain on the account. Parked domains, redirect domains and retired brands are the ones attackers reach for, precisely because nobody is watching them. A domain that sends no mail still needs a DMARC record saying so.
6. Re-run it after each change, then on a schedule. A check describes configuration as it stands. Certificates get reissued, DNS records get edited, registrar settings get changed by someone who was not in the room. What passes today can drift out of compliance without anyone touching the security work itself.

Stated in DNS terms, a domain security policy is four things: a DMARC record at an enforcing policy so receivers act on spoofed mail, an SPF record whose qualifier actually rejects unlisted senders instead of merely marking them, an MTA-STS policy published and set to enforce so mail cannot be downgraded out of TLS in transit, and a CAA record naming the certificate authorities permitted to issue for you. The rest of the checks on this page support those four.

Domain trust score vs SEO domain authority

“Domain trust” is used for three unrelated things, so it is worth saying plainly which one this page is. Several SEO platforms publish a domain trust or domain authority metric derived from a site’s backlink profile, as a proxy for how favourably search engines treat it. ShieldMarc does not calculate anything of that kind. The score here has no bearing on search rankings and should not be compared with one.

The same phrase appears in Windows administration, where verifying a domain trust means testing the trust relationship between two Active Directory domains. That is an internal directory task, carried out against a domain controller, and this tool has nothing to say about it.

This page is the third meaning: a security reading of a domain from the outside. It asks whether your public DNS, mail authentication and certificate configuration would stop an outsider sending email as you, obtaining a certificate in your name, or forging your DNS answers. Everything it reports is observable by anyone on the internet, which is exactly why it is worth knowing what it says about you.

For MSPs: a language your clients understand

Clients don't want to hear about SPF qualifiers or TLS reporting. They want to know whether their domain is safe. A letter grade from an external audit is a language the whole room understands, from the board to the helpdesk. Run a check in a meeting, show the grade, and the conversation shifts from “why do I need this?” to “how do we move from C to A?”

Need continuous monitoring?

This free tool is a point-in-time scan. Certificates expire, DNS records drift, DMARC policies get relaxed. With continuous monitoring in ShieldMarc, you are alerted the moment your grade drops, see the trend across all your domains, and can export white-label reports. Start a free trial for 30 days free.