What's a Good Email Security Rating? How to Read Your Grade

A good email security rating is an A or a B: SPF, DKIM, and DMARC are all present, and your DMARC policy is set to enforce — quarantine or reject, not just none. Anything graded C or below means at least one of those three records is missing, broken, or sitting in monitor-only mode, and your domain can still be spoofed or sent straight to spam.

Most people check their rating expecting a pass/fail. It's not that simple — a domain can have some authentication in place and still land on a D, because a rating measures how completely your records work together, not whether any single record exists.

How an email security rating is actually scored

A real rating checks four things, not one:

• SPF — which mail servers are allowed to send as your domain
• DKIM — whether outgoing mail carries a verifiable cryptographic signature
• DMARC — what receivers should do when SPF or DKIM fails (and whether that instruction is being enforced)
• MX records — whether your domain can receive mail at all, which some receivers use as a trust signal

Each one is graded independently, then combined. A domain that nails SPF and DKIM but leaves DMARC at p=none doesn't get a passing combined grade, because p=none is a reporting mode, not an enforcement policy — it tells receivers "tell me what fails" instead of "block what fails."

Why "I have SPF" isn't the same as "I have a good rating"

This is the most common gap we see. SPF is usually the first record anyone sets up, because most email platforms (Google Workspace, Microsoft 365, SendGrid) walk you through it during setup. So a lot of domains have SPF and nothing else — and the owner assumes that's "email security" handled.

SPF only checks whether the sending server's IP is on your approved list. It says nothing about:

• Whether the message content was altered in transit (that's DKIM)
• What happens when a spoofed message fails SPF (that's DMARC's job)
• Whether your domain can be used in a lookalike attack targeting your own customers

A domain with SPF only and nothing else typically rates a C or D — functional, but with real gaps a spoofer can walk through.

The DMARC policy gap that tanks ratings

Even domains with all three records present get capped below an A if DMARC is set to p=none. Here's the enforcement ladder and what each step earns:

p=none exists for a reason — it's the safe first step so you can review DMARC aggregate reports before you start blocking mail. But it's meant to be temporary. A domain that's been sitting at p=none for months isn't "DMARC compliant," it's DMARC-monitoring, and a real rating reflects that difference.

What actually moves you from a C to an A

In order of impact:

1. Publish DKIM if you haven't. This is usually the single biggest jump — a lot of domains skip it because SPF is the default most platforms set up automatically, and DKIM requires an extra step.
2. Add a DMARC record if you don't have one, starting at p=none to collect reports safely.
3. Review your DMARC aggregate reports for a few weeks, confirm your legitimate sending sources (your email platform, any marketing tool, your CRM) are all passing.
4. Move DMARC to p=quarantine, then p=reject once you're confident nothing legitimate is failing.
5. Trim your SPF record if you're near the 10-DNS-lookup limit — too many include: statements causes SPF to fail silently, which drags the rating back down even though a record exists.

Each step is independent and additive — you don't need to do them all at once, but skipping DMARC enforcement is what keeps most domains stuck below a B long-term.

Check your grade free

Don't guess what's broken — see it. Scan your domain free at emailsecuritygrade.com and get an instant A-F grade on your SPF, DKIM, DMARC, and MX records, with a plain-language fix for anything failing. No signup, no install — it runs in your browser.

If your emails are still landing in spam after fixing the records, a deliverability tool like InboxAlly can train mailbox providers to trust your sending — worth a look once your grade is solid.