Top recommendations
Sorted by impact on the overall scoreAll checks at a glance
Overall score = weighted average of all applicable criteria. Weight 5 = essential, 1 = nice to have.
PDF report & fix plan by email
Optional. Get the full report with all criteria, priorities and ready-to-use DNS snippets as a PDF.
How the Domain Trust Check works
- Enter a domain (e.g. example.com) – no sign-up, nothing to install.
- The check queries DNS, mail servers, web servers, blocklists and RDAP live and rates 17 criteria in four categories.
- You get an overall score from 0 to 100, a grade from A+ to F and the most important fixes – ranked by impact, with DNS snippets to copy.
The 17 criteria and their weights
Every criterion has a weight from 1 (nice to have) to 5 (essential). Criteria that do not apply to a domain – such as DKIM for a domain that sends no mail – are marked “not applicable” and left out of the score.
Email authentication
| Criterion | Weight | What is checked |
|---|---|---|
| SPF main domain | 5/5 | Exactly one valid SPF record (v=spf1), a clear policy for other servers (-all or ~all), at most 10 DNS lookups, all includes resolvable, no deprecated ptr mechanism. |
| SPF for subdomains | 5/5 | Active subdomains such as www, mail or shop that send no mail should publish “v=spf1 -all” – or be covered by DMARC sp=reject so attackers cannot spoof them. |
| DKIM | 5/5 | Looks for public DKIM keys at <selector>._domainkey across about 150 common selectors (custom selector optional) and checks for test mode (t=y) and revoked keys. |
| DMARC | 5/5 | DMARC record at _dmarc, policy p=none/quarantine/reject, percentage (pct), aggregate reports (rua) incl. authorisation of external receivers, subdomain policy (sp) and alignment (adkim/aspf). |
| BIMI | 1/5 | BIMI record at default._bimi, logo in SVG Tiny PS format, mark certificate (VMC/CMC) and the DMARC quarantine or reject prerequisite. |
Mail transport & reputation
| Criterion | Weight | What is checked |
|---|---|---|
| MX configuration | 5/5 | MX records present or null MX (RFC 7505), all MX hosts resolvable, no CNAME, public IP addresses, matching reverse DNS (PTR), redundancy and IPv6. |
| MTA-STS | 4/5 | TXT record _mta-sts, policy file via HTTPS at mta-sts.<domain>/.well-known/mta-sts.txt, mode (enforce/testing), syntax, all MX hosts covered and a sensible max_age. |
| TLS-RPT | 4/5 | TLS-RPT record at _smtp._tls with a valid report address (rua), so Gmail, Microsoft and others report failed encrypted deliveries. |
| DANE/TLSA for mail | 4/5 | MX hosts signed with DNSSEC, TLSA records at _25._tcp for every MX and recommended parameters (3 1 1 or 2 1 1). |
| Blocklists & reputation | 3/5 | Looks up mail and web server IPs on Spamhaus ZEN, SpamCop, Barracuda, PSBL, Mailspike and UCEPROTECT, and the domain on Spamhaus DBL and SURBL. |
Web & certificates
| Criterion | Weight | What is checked |
|---|---|---|
| HTTPS main domain | 5/5 | Reachable via HTTPS, trusted and matching certificate, remaining validity, TLS 1.2/1.3 instead of TLS 1.0/1.1, permanent HTTP→HTTPS redirect and HSTS. |
| HTTPS www | 5/5 | The same checks for the www subdomain. If there is no www subdomain, the criterion is not applicable. |
| Security headers | 2/5 | HTTP security headers of the actual landing page: Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy and no version disclosure. |
| CAA | 4/5 | CAA record with issue and issuewild entries, iodef report address and whether the CA of the current certificate is allowed. |
DNS & domain
| Criterion | Weight | What is checked |
|---|---|---|
| DNS configuration | 5/5 | At least two authoritative nameservers, SOA serial in sync, registry delegation matching the zone, spread across networks, IPv6 and plausible SOA values. |
| DNSSEC | 5/5 | DS record at the registrar, DNSKEY in the zone, successful validation (AD flag) and a modern signing algorithm. |
| Domain registration | 3/5 | Registration data via RDAP (successor of WHOIS): expiry date plus transfer, delete and update locks against domain hijacking. |
How the score is calculated
Each criterion consists of several sub-checks with points and gets a value from 0 to 100 % (90 % and above is good, 50 % and above can be improved, below is critical). The overall score is the weighted average of all applicable criteria. The top fixes are ranked by how many points they add to the overall score.
Grades: A+ from 95 points · A from 85 · B from 70 · C from 55 · D from 40 · F below.
Frequently asked questions
What does the Domain Trust Check test?
It tests 17 criteria in four categories: email authentication (SPF, SPF for subdomains, DKIM, DMARC, BIMI), mail transport and reputation (MX, MTA-STS, TLS-RPT, DANE, blocklists), web and certificates (HTTPS for the main domain and www, security headers, CAA) and DNS and domain (nameservers, DNSSEC, registration). All tests run live against the domain's public DNS, mail and web servers.
Is the check free?
Yes. The Domain Trust Check is free and requires no sign-up. Optionally you can have the full report sent to you as a PDF by email.
How is the score calculated?
Each criterion gets 0 to 100 % and a weight from 1 to 5. The overall score is the weighted average of all applicable criteria. The grade follows from it: A+ from 95, A from 85, B from 70, C from 55, D from 40, otherwise F.
Why do my emails go to spam?
Common causes are a missing or broken SPF record, no DKIM signature, no DMARC record, missing reverse DNS for the mail server or a listing on a blocklist such as Spamhaus. Since February 2024 Gmail and Yahoo require SPF or DKIM from all senders and SPF, DKIM and DMARC from bulk senders (more than 5,000 messages a day); Microsoft has had similar requirements since May 2025. The check flags exactly these items with their spam relevance.
Why can't the check find my DKIM key?
DKIM keys live under a freely chosen selector (<selector>._domainkey.<domain>) that cannot be listed from DNS. The check tries about 150 common selectors, including those of Google, Microsoft 365, Mailchimp, IONOS and Strato. If yours is not among them, enter it under “Specify DKIM selector”. You can find it in the DKIM-Signature header of a sent message (s=…).
Do I need MTA-STS and DANE?
Both protect inbound email from being delivered unencrypted or to a spoofed server. MTA-STS works without DNSSEC and is honoured by Gmail and Microsoft; DANE requires DNSSEC and is used by e.g. web.de, GMX, Posteo and Microsoft. Together with TLS-RPT you learn when an encrypted delivery fails.
What does “not applicable” mean?
Some criteria do not apply to every domain: a domain that sends no mail according to SPF needs neither DKIM nor BIMI; a domain that receives no mail needs no MTA-STS, TLS-RPT or DANE. Such criteria are not counted in the score.
How often should I check my domain?
After every change to DNS, mail server or hosting – and regularly, e.g. monthly, to catch expiring certificates, blocklist listings or forgotten records early. Results are cached for 15 minutes; “Re-check” starts a fresh check.
Who is behind the Domain Trust Check?
The check is provided by Soll IT Consulting from Thaleischweiler-Fröschen (Rhineland-Palatinate, Germany), an IT service provider for domains, DNS, email and hosting. If you need help implementing the recommendations, you can request a fix directly.