Email Security
100 points total
Assesses email authentication and anti-spoofing controls — SPF policy strength, DMARC enforcement level, DKIM selector discovery, and MX record hygiene.
Checks
| Check | Weight | What it measures |
|---|---|---|
DMARC Policy Enforcement email_dmarc_policy_enforcement | 30 pts | Evaluates the DMARC policy level (none, quarantine, reject) and whether it actively prevents spoofed mail. |
SPF Policy Strength email_spf_policy_strength | 25 pts | Checks whether the SPF record uses a strict qualifier (-all) versus permissive (~all or ?all). |
DKIM Selector Discovery email_dkim_selector_discovery | 25 pts | Probes common DKIM selectors to verify that at least one valid DKIM public key is published. |
MX Presence & Hygiene email_mx_presence_and_hygiene | 20 pts | Checks whether MX records are present and properly configured for mail delivery or explicitly null. |
Pass / Warn / Fail Logic
DMARC Policy Enforcement
Pass if p=reject or p=quarantine; warn if p=none; fail if no DMARC.
SPF Policy Strength
Pass if -all; warn if ~all; fail if +all or missing.
DKIM Selector Discovery
Pass if a valid selector is found; fail if none discovered (may be false negative with custom selectors).
MX Presence & Hygiene
Pass if valid MX or null MX; fail if no MX record.
Findings & How to Fix Them
These are the specific findings RedScore may report for this category, along with remediation guidance.
EMAIL_SPF_MISSINGPublish an SPF TXT record for your root domain and use a restrictive policy ending in -all.
EMAIL_DMARC_MISSINGPublish a DMARC record at _dmarc.<domain> with at least p=none and move to p=quarantine/reject.
EMAIL_SPF_WEAK_POLICYHarden SPF policy toward -all to prevent unauthorized senders from passing SPF checks.
EMAIL_DMARC_NON_ENFORCEDSet DMARC policy to p=quarantine or p=reject to enforce anti-spoofing protections.
EMAIL_DKIM_NOT_FOUNDIf you use a custom DKIM selector not in our test list, this may be a false negative. Otherwise publish a DKIM TXT at <selector>._domainkey and ensure your mail flow signs with it.
EMAIL_MX_MISSINGIf mail is used, publish valid MX records. If mail is not used, publish a null MX record (MX 0 .).