Security score

Each domain gets a grade from A to F and a list of checks, so you see at a glance what is set up well and what to fix next. Every check says what MailGlo found, what we recommend and offers the next step.

What each colour means

Every check shows a label and an icon as well as its colour.

• Good (green): set up well.
• Could be better (yellow): it works, but a change would make it stronger.
• Needs a fix (red): broken, or it leaves the domain open to misuse.
• Not enough data (grey): MailGlo has not read the record yet, or no reports have arrived. This never counts against the domain.

The checks

1. DMARC record: one valid record applies to the domain, its own or one inherited from a parent domain.
2. DMARC policy: the policy that applies, own or inherited, is p=quarantine or p=reject. p=none monitors without protecting, so it could be better; the recommendation says whether reports show you are ready to enforce.
3. DMARC reports: the record asks for aggregate reports and they reach MailGlo.
4. SPF record: evaluated as receivers do, in order and through every include: it fails or soft-fails servers it does not list, within 10 DNS lookups. An error, a server it does not list passing, or a range covering a large part of the internet (an ip4 or ip6 range of /0 or /1) needs a fix.
5. DKIM signing: reported mail carries a DKIM signature aligned with your domain, from every service you confirmed.
6. Confirmed services pass DMARC: mail from the services you use passes.
7. Unconfirmed senders: every service seen sending as your domain has a decision under Sending services.
8. MTA-STS: MailGlo serves an enforced policy with a valid certificate, and the DNS check sees mta-sts. and your domain point at it. A policy hosted elsewhere shows as not enough data.
9. TLS reporting: you receive reports about secure delivery to you.
10. BIMI logo: optional. It never lowers the grade.

The DNS checks read the records from your latest DNS check: MailGlo checks when you add the domain and every 6 hours while it is monitored. Choose Refresh under the domain's DNS records to read them again now. The health check there shows the grade and the checks that need attention; the others are under All checks. The report checks use the last 30 days of reports.

How the grade is worked out

A red check costs 3 points and a yellow one 1. The grade is A at 0 points, B at 1 to 2, C at 3 to 5, D at 6 to 8 and F at 9 or more. The domain page lists every check that cost points. A domain is graded once MailGlo has read its DMARC and SPF records.

The grade describes your configuration and what receivers reported. It is not a promise that mail reaches the inbox, and it is not proof that nobody can spoof your domain.

Prepare the fix

Each check that is not green has a button. Prepare the fix opens the change form with the right kind of change filled in, for example p=quarantine for a DMARC policy or ~all for SPF. Preparing changes nothing: you review the plan, then apply it, or send it for approval. For checks that need a decision rather than a DNS change, such as confirming a sending service, the button opens that page.

Across all your domains

The Domains page counts your domains by grade and lists the ones with checks that need a fix first. Everyone sees the domains they have access to.