How the score is worked out
Every check ends in one of four states. A pass earns one point, a warning half a point and an error nothing. Informational results are set aside. The score is the points earned divided by the number of scored checks, as a percentage rounded to a whole number. A report with 26 scored checks, of which 20 pass, 4 warn and 2 fail, earns 22 points out of 26, which rounds to 85.
Grades follow fixed bands: A from 90, B from 80, C from 70, D from 60 and F below that. Each category bar uses the same arithmetic over that category's checks alone. All checks carry equal weight, so the number tells you how many things are wrong, not how badly. A DS record that matches no key costs one point, the same as a second SPF record, yet the first takes the whole domain offline for validating resolvers and the second affects mail only.
What sits behind each bar
Nameservers covers delegation: at least two servers, hostnames that resolve to public addresses, every server answering for the zone with the same SOA serial, more than one IPv4 /24 network and at least one IPv6 address. SOA compares the refresh, retry, expire and minimum timers with recommended ranges. Web looks for a CNAME at the apex (an error), A and AAAA records at the apex and a www name that resolves.
Mail checks that MX records exist, name hostnames instead of IP addresses or aliases, and resolve. Email Security wants exactly one SPF record ending in ~all or -all and a DMARC policy of quarantine or reject. DNSSEC is a single check, which is why that bar only ever reads 0, 50 or 100: a broken chain, an unsigned or half-configured zone, or a DS record that matches a published key.
Raising a low score in the right order
Take the errors first, and within them the ones that stop the domain resolving or lose mail: a DS record that matches no key, nameservers that do not resolve or answer, MX hosts with no address. Next come the spoofing gaps, meaning a missing or duplicated SPF record and a missing DMARC record. Warnings such as no IPv6, an unsigned zone or p=none can be scheduled.
- Email Security in the red: build the records with SPF Generator and DMARC Generator, publish them and re-run.
- Mail at 50 percent on a domain that handles no mail: publish a null MX (priority 0, target a single dot) so the check becomes informational.
- DNSSEC at 50 percent: sign the zone at your DNS host and add the DS record at the registrar.
- Nameservers below 100: the table under the cards shows which server fails to respond or reports a different serial.
Scores that look wrong
A site can load perfectly and still earn a D. Browsers need one A record. The score also counts redundancy, mail authentication and DNSSEC, which matter on the day a server fails or someone forges your domain. The opposite happens too: an A says the DNS is configured well, and says nothing about the web server, certificate or mail server behind it.
Lookups go through the public resolvers Cloudflare 1.1.1.1, Google 8.8.8.8 and Quad9 9.9.9.9, and a lookup that times out is counted like a missing record, so a brief resolver hiccup can cost points. If a result surprises you, run it again before changing anything. When the DNS-over-HTTPS query for DS and DNSKEY gets no reply, DNSSEC is reported as undetermined and left out of the score.
When the checklist or another tool fits better
Domain DNS Validation runs the same audit and lays the results out as a checklist grouped by category, which is easier when you want to go rule by rule instead of by priority. If the score is fine but a recent edit is not visible everywhere, that is caching, not health, and DNS Change Analyzer shows what public resolvers currently return for the record.