# IntoDNS.ai Scoring System

IntoDNS.ai scores domains on a 0-100% scale across 5 categories with weighted averages.

## Category Weights

| Category | Weight |
|----------|--------|
| DNS Configuration | 20% |
| DNSSEC | 15% |
| IPv6 Support | 15% |
| Email Security | 30% |
| Security Best Practices | 20% |

## Grading Scale

| Grade | Percentage | Label |
|-------|-----------|-------|
| A+ | 97%+ | Excellent |
| A | 93-96% | Very Good |
| A- | 90-92% | Good |
| B+ | 87-89% | Above Average |
| B | 83-86% | Average |
| B- | 80-82% | Below Average |
| C+ | 77-79% | Fair |
| C | 73-76% | Needs Improvement |
| C- | 70-72% | Poor |
| D | 60-69% | Bad |
| F | <60% | Critical |

## Check Severities

- **critical**: Must fix — broken or misconfigured
- **recommended**: Should fix for good security practices
- **optional**: Nice-to-have, not required for operation
- **info**: Informational only, no score impact

## All Checks with Scores

### DNS Configuration (max 65 points scored + info checks)

| Check ID | Name | Points | Severity |
|----------|------|--------|----------|
| has_a_record | A record present | 10 | critical |
| has_aaaa_record | AAAA record present | 15 | recommended |
| has_mx_record | MX records present | 10 | recommended |
| has_ns_record | NS records present | 10 | critical |
| has_soa_record | SOA record present | 5 | critical |
| has_caa_record | CAA record present | 5 | recommended |
| multiple_ns | Multiple nameservers | 5 | recommended |
| ns_geographically_distributed | NS geographically distributed | 5 | recommended |
| soa_format | SOA serial format | - | info |
| soa_timers | SOA timers valid | - | info |
| no_lame_ns | No lame nameservers | - | info |
| glue_records | Glue records present | - | info |
| www_record | WWW record configured | - | info |
| mx_ptr | MX servers have PTR | - | info |

### DNSSEC (max 145 points)

| Check ID | Name | Points | Severity |
|----------|------|--------|----------|
| dnssec_signed | DNSSEC signed | 50 | recommended |
| dnssec_valid | DNSSEC validation OK | 50 | critical |
| chain_of_trust_complete | Chain of trust complete | 10 | critical |
| nsec3_rfc9276 | NSEC3 RFC 9276 compliant | 10 | recommended |
| rrsig_not_expiring | RRSIG signatures valid | 5 | recommended |
| dnssec_modern_algorithm | Modern DNSSEC algorithm (RRSIG) | 5 | optional |
| ds_digest_modern | DS digest algorithm modern | 5 | recommended |
| dnskey_algo_secure | DNSKEY algorithm secure | 5 | optional |
| rrsig_ttl_safe | RRSIG TTL safe | 5 | recommended |

### IPv6 Support (max 100 points)

| Check ID | Name | Points | Severity |
|----------|------|--------|----------|
| ipv6_website | Website reachable via IPv6 | 40 | recommended |
| ipv6_mail | Mail servers via IPv6 | 30 | recommended |
| ipv6_nameservers | Nameservers via IPv6 | 30 | recommended |

### Email Security (max 235 points)

| Check ID | Name | Points | Severity |
|----------|------|--------|----------|
| spf_exists | SPF record present | 15 | critical |
| spf_valid | SPF syntax valid | 10 | critical |
| spf_strict | SPF policy strict (-all) | 10 | recommended |
| dkim_found | DKIM found | 20 | recommended |
| dmarc_exists | DMARC record present | 15 | recommended |
| dmarc_quarantine | DMARC quarantine or better | 10 | recommended |
| dmarc_reject | DMARC policy reject | 20 | optional |
| bimi_exists | BIMI record present | 5 | optional |
| bimi_valid | BIMI configuration valid | 5 | optional |
| mta_sts_exists | MTA-STS record present | 5 | optional |
| mta_sts_enforced | MTA-STS policy enforced | 10 | optional |
| mx_valid | MX records valid | 10 | critical |
| mx_dnssec_signed | MX domains use DNSSEC | 10 | recommended |
| mx_dnssec_valid | MX DNSSEC validation OK | 10 | recommended |
| not_blacklisted | Mail servers not blacklisted | 25 | critical |
| no_critical_blacklist | No critical blacklist listings | 20 | critical |

### Security Best Practices (max 195 points)

| Check ID | Name | Points | Severity |
|----------|------|--------|----------|
| has_caa | CAA records present | 10 | recommended |
| caa_strict | CAA policy strict | 10 | optional |
| has_tlsa | TLSA records (DANE) | 20 | optional |
| tlsa_valid | DANE configuration valid | 15 | optional |
| no_txt_leakage | No sensitive info in TXT | 20 | critical |
| verification_records_review | Verification records reviewed | 5 | info |
| https_available | HTTPS available | 25 | critical |
| https_redirect | HTTP redirects to HTTPS | 15 | critical |
| hsts_enabled | HSTS enabled | 15 | recommended |
| hsts_long_max_age | HSTS max-age >= 1 year | 10 | optional |
| x_frame_options | X-Frame-Options header | 10 | recommended |
| x_content_type_options | X-Content-Type-Options header | 10 | recommended |
| content_security_policy | Content-Security-Policy header | 15 | recommended |
| referrer_policy | Referrer-Policy header | 10 | recommended |
| security_txt_exists | security.txt present | 5 | optional |
| security_txt_valid | security.txt valid | 5 | optional |
| http3_supported | HTTP/3 (QUIC) supported | 5 | optional |
| http3_quic_reachable | QUIC UDP reachable | 5 | optional |
| https_dns_record | HTTPS DNS record (SVCB) | 5 | optional |

## DNSSEC Unsupported TLDs

Domains on TLDs that don't support DNSSEC at the registry level (e.g., .ai, .cm, .gt) receive full DNSSEC and DANE/TLSA points automatically — they are not penalized for limitations outside their control.

## Improving a Score

Common improvements include:
- Enabling DKIM signing
- Enforcing DMARC policy (p=reject)
- Reducing SPF complexity (< 10 DNS lookups)
- Enabling DNSSEC at your registrar
- Adding security headers (HSTS, CSP, X-Frame-Options)
- Removing blacklisted IPs
- Adding IPv6 (AAAA) records

## Limitations

- Scores are advisory, not guarantees of inbox placement
- Inbox placement also depends on recipient behavior and engagement
- Some checks require cooperation from your DNS provider or registrar

---

Last updated: 2026-02-18