How the score is calculated

The formula

score = max(0, 100 − Σ weight(check) × (1 − credit(check.severity)))

Each check that grades a real fault (kind: "defect") has a weight — how many points it costs on a full fail. A warn on the same check costs half that; a pass costs nothing. A lame delegation and a missing DMARC record are not the same finding, so they do not cost the same — the table below is every weight, in one place, exactly as the code reads it.

The exemption belongs to a finding, not to a check. A result graded kind: "hardening" — see "defect or hardening" on the full catalogue — never costs anything and can only be pass, info, unknown or not_applicable: no DNSSEC, no CAA and no security.txt are each exactly that — absent, not broken. The same check can still grade defect when the feature is deployed but broken, and that does cost points: a DNSSEC chain with a DS record and no DNSKEY, or a security.txt published with no Contact field, are findings about something that exists and is wrong, not about something missing.

info, unknown and not_applicable also cost nothing — see severity on the full catalogue for what each of those means. unknown in particular is our own gap, most often a blocked outbound port on the machine running the scan, and marking a domain down for it would be a false accusation about somebody else’s infrastructure.

A worked example

A domain with one failing check and one warning, and nothing else wrong:

ns.open-recursion fails    → −16 points (full weight)
mailauth.spf-all warns     → −4 points  (half of 8)
everything else passes     → −0 points

score = 100 − 16 − 4 = 80

Fix the warning without touching the failure and the score moves to 84. Fix both and it is 100. Nothing about either change depends on what else is passing, and adding a third problem always costs more, never less.

Every weight

Points deducted on a full fail. A check that can grade a real fault and has no row here would fall back to 8 rather than deduct nothing, so a newly added check is never accidentally free — a dedicated test refuses to let that fallback cover for a check nobody has actually reviewed and weighted on purpose. 5 checks are intentionally absent below — each of those can only grade pass, info, unknown or not_applicable, so a weight for it would be dead code.

When there is no score at all

A domain that was never meaningfully present in DNS gets no score — not a low one. A low score is still a real measurement; a domain with nothing behind it has nothing to measure, and 0 would read as a graded result rather than an absent one. The report shows No score and names the reason:

not_delegated

The registry has no delegation for this name — never registered, expired and deleted, or registered with no nameservers set.

registry_unreachable

No server for the registry could be found or answered, so nothing below that point could be compared against it either.

no_nameservers_responded

Every nameserver the registry lists failed to answer — over UDP and over TCP.

This is different from a domain that resolves fine but has no registration record on file, or carries a registry hold or pending-deletion status — those score 0 outright, because the domain really was measured and really is unreachable above the DNS layer.