Scoring Methodology & Operational Transparency Guide
Diagnostic Scope & Purpose Notice
“ScoreSender’s score is a diagnostic indicator built from DNS authentication and public reputation signals. It helps identify configuration and reputation risks; it is not a prediction or guarantee of inbox placement.”
ScoreSender uses a transparent, documented scoring model. Individual checks are based on observable DNS and public reputation signals, while the point weights and thresholds are product-defined diagnostic rules.
Scoring Methodology & Diagnostic Framework
Methodology Version v1.1 • Updated August 2026
1. Data Sources & Audit Scope
ScoreSender performs non-intrusive DNS queries against publicly published domain records and public reputation feed zones. We do not require tracking pixels, agent installations, or access to your internal email content or subscriber lists.
Authentication Signals (70% Total Weight)
Evaluates published DNS records according to IETF standards.
- SPF TXT Record: Evaluates syntax, enforcement mechanisms (
-allvs~all), and DNS lookup limits. - DKIM Key Verification: Audits standard selectors (
google,k1,s1,default,mail) or user-configured custom selectors. - DMARC Enforcement: Validates policy directives (
p=reject,p=quarantine,p=none) and reporting URIs (rua).
Public DNSBL Reputation (30% Total Weight)
Queries 8 configured major public blocklist providers.
- Configured providers: Spamhaus ZEN, Barracuda BRBL, Spamcop, SORBS, Abuseat CBL, Manitu IX, PSBL, GBUdb Truncate.
- Discovers sending IPs via SPF records, domain A records, and MX mail exchange records.
- Queries DNSBL list zones to detect active listings.
2. Authentication Evaluation & Selector Discovery
DKIM Selectors & Verification Note
A custom selector is not inherently less secure. If the selector cannot be discovered or verified, the result may be marked partial or Not Checked until the selector is provided.
Plain language: DKIM acts like a cryptographic digital stamp. If your email provider uses a unique private selector name (e.g., s2026._domainkey.example.com) that is not in our standard scanner list, you can input the selector name in your domain settings to enable complete verification.
Evaluates authorized IP ranges. -all enforces strict rejection, ~all indicates soft fail, while +all allows any sender.
Audits published public key records (RSA 2048-bit / Ed25519) to ensure cryptographic signature alignment.
Evaluates enforcement policies (p=reject vs p=quarantine vs p=none) and aggregate reporting (rua).
3. What DNSBL Checking Means & Technical Nuances
A Domain Name System-based Blackhole List (DNSBL) is a database operated by independent cybersecurity organizations to track IP addresses and domain names associated with unauthenticated, bulk, or suspicious email activity.
What is Actually Checked & IP Discovery
- Sending IP vs Domain Web IP: Your website's web server IP (domain A record) is often distinct from your outbound mail server IPs (e.g. Google Workspace, SendGrid, Mailchimp, or dedicated MTA IPs).
- IP Discovery Sources: ScoreSender extracts sending IPs from published SPF
ip4/ip6blocks, domain MX mail exchanger records, and website A records. - Targeted DNSBL Queries: Extracted IPs are reverse-queried against configured list zone servers.
Provider Policies & Listing Interpretation
- Provider Policies Differ: Each DNSBL provider (e.g. Spamhaus, Barracuda, SORBS) maintains independent listing criteria, threat classifications, and removal policies.
- Listing Scope: A blocklist listing is a material reputation signal that warrants investigation. It does not by itself predict inbox placement. It indicates an active listing on that provider's database, not proof that all outbound messages are spam.
- Delisting Responsibility: ScoreSender detects listing status, but delisting requests must be performed directly with the respective blocklist provider.
4. Diagnostic Check States & Unavailability Handling
To maintain data integrity, ScoreSender distinguishes clearly between clean checks, uncollected data, network timeouts, and historical snapshots:
No evidence of a problem. The check executed successfully and no configuration defect or listing was observed.
Check unavailable. Remote DNS server timed out (>3,500ms) or was unreachable.
This is a provisional neutral treatment for scoring continuity. It does not mean the provider confirmed that the domain or IP is clean.
Data not collected. An optional signal (e.g. custom DKIM selector or OAuth token) was not provided or omitted.
Old data snapshot. Preserved historical result from a prior scheduled audit pending live refresh.
5. Mathematical Point Distribution & Case Matrix
ScoreSender uses a transparent, documented scoring model. Individual checks are based on observable DNS and public reputation signals, while the point weights and thresholds are product-defined diagnostic rules.
SPF Record Authentication
Validates Sender Policy Framework TXT record defining authorized outbound email senders for your domain.
SPF acts like an approved guest list of servers allowed to send emails on behalf of your domain.
| Evaluation Condition | Points Awarded | Example Record Syntax | Impact Analysis & Meaning |
|---|---|---|---|
| Strict Pass (-all) | 25 / 25 | v=spf1 include:_spf.google.com -all | Strict fail mechanism configured. Full points awarded. |
| SoftFail (~all) | 21 / 25 | v=spf1 include:mail.sendgrid.net ~all | Soft fail mechanism configured. Minor 4-point deduction. |
| Insecure (+all) | 10 / 25 | v=spf1 +all | Allows any server to send mail. Major security configuration vulnerability. |
| Missing / No SPF | 0 / 25 | No TXT record found | Zero points. Domain lacks authorized sender verification. |
DKIM Key Signing
Verifies DomainKeys Identified Mail cryptographic signature selector published on DNS.
DKIM attaches a digital signature to your emails to prove they were not modified in transit.
| Evaluation Condition | Points Awarded | Example Record Syntax | Impact Analysis & Meaning |
|---|---|---|---|
| Valid Standard Selector Found | 20 / 20 | google._domainkey.example.com TXT "v=DKIM1; k=rsa; p=MIGf..." | Public RSA/Ed25519 key verified on standard selectors. Full points awarded. |
| Custom / Private Selector | 14 / 20 | k1._domainkey.example.com | A custom selector is not inherently less secure. If the selector cannot be discovered or verified, the result may be marked partial or Not Checked until the selector is provided. |
| Missing / Unverifiable Key | 0 / 20 | No _domainkey records | Zero points. Domain lacks public cryptographic signature verification. |
DMARC Policy Enforcement
Evaluates Domain-based Message Authentication, Reporting, and Conformance policy enforcement.
DMARC tells receiving inbox servers what action to take if an email fails SPF or DKIM checks.
| Evaluation Condition | Points Awarded | Example Record Syntax | Impact Analysis & Meaning |
|---|---|---|---|
| Reject Policy (p=reject) | 25 / 25 | v=DMARC1; p=reject; rua=mailto:dmarc@example.com; | Strict rejection policy configured against spoofing. Full points awarded. |
| Quarantine Policy (p=quarantine) | 20 / 25 | v=DMARC1; p=quarantine; pct=100; | Quarantine policy configured. Minor 4-point deduction. |
| None Policy (p=none) | 15 / 25 | v=DMARC1; p=none; | Monitoring mode only. No active enforcement applied against unauthenticated mail. |
| Missing DMARC Record | 0 / 25 | No _dmarc record | Zero points. Domain lacks policy enforcement against impersonation. |
8 DNSBL Blocklist Cleanliness
Queries 8 configured major public DNSBL blocklist providers (Spamhaus ZEN, Barracuda BRBL, Spamcop, SORBS, Abuseat CBL, Manitu IX, PSBL, GBUdb Truncate).
DNSBLs are public databases tracking IP addresses flagged for suspicious or unauthenticated email traffic.
| Evaluation Condition | Points Awarded | Example Record Syntax | Impact Analysis & Meaning |
|---|---|---|---|
| Clean across 8 Blocklists | 30 / 30 | 0 Hits / 8 Checked | No active listings observed across configured public providers. Full 30 points awarded. |
| Listed on 1 Blocklist | 15 / 30 | 1 Hit (e.g. Spamhaus ZEN) | 15-point deduction. A blocklist listing is a material reputation signal that warrants investigation. It does not by itself predict inbox placement. |
| Listed on 2+ Blocklists | 0 / 30 | 2+ Active Hits | Zero points. Multiple active listings indicate elevated deliverability risk; investigation and delisting recommended. |
| Provider Timeout / Unknown | 15 / 30 | DNS query timed out | This is a provisional neutral treatment for scoring continuity. It does not mean the provider confirmed that the domain or IP is clean. |
6. Operational Limitations & Disclaimers
ScoreSender monitors DNS, authentication, and public reputation signals. These signals are different from mailbox-provider data such as Gmail user-reported spam rates. A healthy DNS configuration does not guarantee a low complaint rate or inbox placement.
No Inbox Placement Guarantee Statement:
“ScoreSender does not guarantee inbox placement. Mailbox providers also use engagement, complaint, content, authentication alignment, sending history, and proprietary signals.”
A blocklist listing is a material reputation signal that warrants investigation. It does not by itself predict inbox placement.
7. Report Data Discrepancy or Feedback
If you observe a false positive, DNS caching latency, unlisted DKIM selector issue, or wish to submit feedback regarding our diagnostic rules, please contact our deliverability operations team.