How the score and the grade are computed
The score starts at 100 and loses 30, 12, 5 or 1 point per critical, high, medium or low finding, repeats counting a quarter. Grades A to F.
Every audit gives the domain a score out of 100 and a grade from A to F. The score is there to show progress over time and to rank what to fix first. It is not a certification: a perfect score does not mean nothing can go wrong.
How the score is computed
The score starts at 100. Each open finding takes points off according to its severity:
| Severity | Points taken off |
|---|---|
| Critical | 30 |
| High | 12 |
| Medium | 5 |
| Low | 1 |
| Info | 0 |
The same kind of finding counts fully once, then a quarter for each repeat. When ten hosts miss the same security header, the first one costs its full weight and each of the nine others a quarter of it, so one forgotten setting repeated across a large site does not sink the whole score. A kind of finding is one check (the identifier shown under each finding); its most serious occurrence is the one counted fully.
The total is rounded, and the score never goes below 0.
The grades
| Grade | Score |
|---|---|
| A | 90 and above |
| B | 75 to 89 |
| C | 60 to 74 |
| D | 40 to 59 |
| F | below 40 |
An example
A domain has no DMARC policy (high), the same security header missing on four hosts (medium) and no CAA record (low):
- the missing DMARC policy: 12 points;
- the header: 5 points for the first host, then 1.25 for each of the three others, 8.75 in all;
- the CAA record: 1 point.
100 − 12 − 8.75 − 1 = 78.25, so the score is 78, grade B. Publishing the DMARC record alone would bring it to 90, grade A.
Score by family and the simulator
On a domain’s page, Score by family applies the same formula to each family of checks on its own: e-mail, web, DNS, exposure, brand and certificates, and other. A family at 100 has nothing open; the lowest one is where the points are lost.
The Simulate card lists the kinds of findings that bring back the most points. Tick the ones you plan to fix: it shows the score and grade the domain would have, counted exactly as the audit counts it, before you change anything.
What does not count
- Accepted findings. A finding you accepted as a risk is left out of the score until the acceptance expires or is closed. The public badge says how many risks you accepted.
- Info findings. They weigh nothing.
Why the score moves
The score follows the audits: it changes when a finding appears or is fixed, and when one is accepted or its acceptance ends. “Check if it is fixed” tells you within seconds whether a fix worked, but the score itself is updated by the next full audit (use Audit now if you do not want to wait).
A quick check run before the ownership proof scores only the public checks, so the first full audit can come out lower: it looks further.
The score elsewhere in the app
- The dashboard shows the posture of your workspace: the average score of your proved domains, how it moved over 30 days, and what it would be once the first three actions are done.
- Do these first on the dashboard ranks fixes by the points they would bring back, using this same calculation.
- Suppliers and prospects get a score computed the same way, from the public checks only.