Rating

Overall rating

25Reports evaluates the DMARC compliance of a domain on a scale from A to F. The evaluation is based on the analysis of the DNS entries and thus reflects whether the DMARC-relevant DNS entries of a domain are configured sensibly or whether they have errors or non-optimal settings.

You can find an overview of the evaluation of your domains under Monitoring > Overview > Domains.

Double-click a domain to obtain information on the rating of this domain.

Field	Description	States
A	Excellent	Establishment of DMARC/SPF/DKIM completed
B	Good	Setup of DKIM and SPF completed, but DMARC policy p=none
C	Satisfactory	DKIM set-up and basic SPF set-up completed or SPF set-up completed but no DKIM
D	Sufficient	Only DKIM or simple SPF setup completed
E	(Almost) sufficient	Only DMARC reporting activated (no SPF or DKIM)
F	Not sufficient	Nothing configured

How do I improve the rating of a domain?

Each rating contains information on how you can use the DNS records to improve the rating of your domain. We therefore recommend that you implement the information and tips displayed.

History

You can use the history to track changes and problems with your DMARC, SPF and DKIM entries. This is possible as soon as the corresponding domain has been verified.

DMARC

SPF

NOTE: With SPF, all includes and redirects are also checked for changes.

DKIM

For DKIM, the history is displayed for each selector. DKIM selectors are automatically recognised from the incoming DMARC reports, evaluated and included in the assessment. As soon as a DKIM selector is reported in a DMARC report for a domain, it is automatically added to the list of known selectors for this domain. Any DNS problems are displayed in the detailed view on the Problems tab.

NOTE: Users who have set up the DMARC/SPF/DKIM DNS records change alert may receive an alert when new DKIM selectors are recognised for the first time.

Calculation of the overall DKIM status

The overall DKIM status of a domain is derived from the status of the individual selectors. The following rules apply:

No selector found

• If no DKIM selector has been found so far, this is considered a problem for active domains.

• Inactive domains do not require a DKIM configuration and can receive an A rating even without a selector.

Selectors available

• The worst selector status determines the overall DKIM status.

• DKIM is only considered fully configured for active domains if at least one selector is available and all selectors found are valid.

Selector status

Valid

• There are no problems with the DNS record or signature.

Revoked

• The public DKIM key has been revoked.

Signature not validated

• The selector was reported in the DMARC reports.

• DKIM authentication has so far failed every time it has been checked.

As soon as DKIM authentication has been successfully performed at least once according to the DMARC reports, the status changes to "Complete" provided there are no DNS problems.

Invalid signature

• There are problems with the signature.

Invalid DNS record

• There are problems with the DNS record.

Suboptimal DNS record

• Entries that deviate from an ideal configuration and may not function as desired.