Sample report
Your domains' reputation, in one report
This is the report MailThreatZero keeps for every protected domain: how blocklists, receivers and DNS see the domain, what is costing it points, and the exact record to publish to fix each problem.
Sample data. northwind.example is a fictional domain and every address is from a documentation range. The score, the points and the DNS records are produced by the same code the console uses.
northwind.example
73.5 / 100 Fair
MTZ External Reputation Score. Checked about every six hours.
16 of 18 checks completed 1 unknown: Barracuda: 203.0.113.25 1 not checked: Spamhaus: 203.0.113.25
This score reflects completed checks. Unknown and unperformed checks are listed separately and do not count as passes. Sample data: no real check times are shown.
What is reducing the score
Select a line to see the evidence and the exact fix.
| Points | Signal | Severity |
|---|---|---|
| −8 | 12% of reported mail failed DMARC | medium |
| −8 | PSBL lists 203.0.113.25 | medium |
| −3 | DMARC policy is p=none | low |
| −3 | New sending source 198.51.100.77 | low |
| −2 | DKIM key selector2 is 1024-bit | low |
| −1 | No MTA-STS policy | info |
| −1 | DNSSEC not enabled | info |
| −0.5 | No TLS-RPT record | info |
Starts at 100; each problem removes the points shown. An open high-severity problem caps the score at 69 and a critical one at 34. Grades: Excellent 90+, Good 75+, Fair 55+, Poor 35+. Sources that could not be checked add and remove nothing.
Why it changed this week
- 4 days ago PSBL started listing 203.0.113.25 −8
- 2 days ago New sending source 198.51.100.77 in DMARC reports −3
Alerts sent
- New blocklist listing: PSBL lists 203.0.113.25 (emailed once, when it appeared)
- New sending source 198.51.100.77 (emailed once)
Authentication
SPF, DKIM and DMARC as published in your DNS.
PassSPF record
Published and valid: v=spf1 include:spf.protection.outlook.com ip4:203.0.113.25 ~all. Within the limit of 10 lookups.
Source: dns
PassDKIM key selector1
2048-bit RSA key published at selector1._domainkey.
Source: dns
WarningDKIM key selector2 is 1024-bit−2
selector2 still publishes a 1024-bit key. It verifies today, but 2048-bit is the current recommendation.
How to fix: Rotate selector2 to a 2048-bit key
Generate a 2048-bit key in your mail platform, publish it, then retire the 1024-bit one.
Source: dns
WarningDMARC policy is p=none−3
Receivers are asked to take no action on mail that fails DMARC, so the record reports on spoofing but does not stop it.
How to fix: Move DMARC to p=quarantine
Once the failing sources below are fixed, ask receivers to quarantine mail that fails.
TXT _dmarc.northwind.example
v=DMARC1; p=quarantine; rua=mailto:dmarc@northwind.example; fo=1
Your current record with only the policy changed; every other tag is kept.
- after the failing sources are fixed
Source: dns
What receivers report
DMARC aggregate reports sent by the mailbox providers that received your mail.
Warning12% of reported mail failed DMARC−8
3,412 messages reported by 14 receivers in the last 7 days; 409 failed. Most failures come from 198.51.100.77, which is not in SPF.
How to fix: Authorize or stop 198.51.100.77
If it is your newsletter platform, add it to SPF and sign its mail with your DKIM key. If you do not recognize it, it is spoofing you.
Source: dmarc_reports
WarningNew sending source 198.51.100.77−3
198.51.100.77 first appeared in receivers' reports 4 days ago, sending as northwind.example.
Source: dmarc_reports
Blocklists
Asked about 203.0.113.25, the domain's own sending server. Shared provider servers are not asked.
Not listedSpamCop: 203.0.113.25
Not listed.
Source: spamcop
UnknownBarracuda: 203.0.113.25
The list did not answer this time. Last successful answer 6 hours ago: not listed. Unknown is not counted as clean, and costs nothing.
Source: barracuda
ListedPSBL lists 203.0.113.25−8
203.0.113.25 is listed on PSBL, a smaller list some receivers use as one input.
How to fix: Request removal of 203.0.113.25 from PSBL
Find what sent the reported mail from that server, stop it, then use PSBL's self-service removal.
Source: psbl
Not checkedSpamhaus: 203.0.113.25
Not checked: Spamhaus requires a commercial DQS key, and none has been supplied. Not checked is not clean.
Source: spamhaus
Sending infrastructure
Who sends as this domain, and whose servers they are.
PassReverse DNS for 203.0.113.25
203.0.113.25 reverses to mail.northwind.example and back.
Source: dns
Mail-security DNS
MX, MTA-STS, TLS-RPT, DNSSEC and BIMI.
PassMX records
Mail is routed to mt0.mailthreatzero.com (the filtering gateway, never scored).
Source: dns
OptionalNo MTA-STS policy−1
Without MTA-STS a sender cannot insist on an encrypted connection to your servers.
How to fix: Publish an MTA-STS policy
Start in testing mode; move to enforce once TLS reports are clean.
TXT _mta-sts.northwind.example
v=STSv1; id=2026100701
Change the id whenever the policy file changes.
File https://mta-sts.northwind.example/.well-known/mta-sts.txt
version: STSv1 mode: testing mx: mt0.mailthreatzero.com max_age: 604800
Serve this file over HTTPS with a valid certificate for mta-sts.northwind.example.
- Point mta-sts.northwind.example at a web server you control (an A, AAAA or CNAME record).
- Start in mode: testing; switch to enforce once TLS-RPT reports show no failures.
Source: dns
OptionalNo TLS-RPT record−0.5
Receivers have nowhere to report failed encrypted deliveries.
How to fix: Publish a TLS-RPT record
Reports arrive daily from the large receivers.
TXT _smtp._tls.northwind.example
v=TLSRPTv1; rua=mailto:tls-reports@northwind.example
tls-reports@northwind.example is a placeholder: use a mailbox you read.
- Reports arrive daily as compressed JSON, one per sending provider.
Source: dns
OptionalDNSSEC not enabled−1
The zone is not signed, so its answers cannot be validated.
How to fix: Enable DNSSEC at your DNS host
Turn on signing at the DNS host, then publish the DS record it gives you at the registrar.
Source: dns
OptionalNo BIMI record
Optional: shows your logo in some inboxes. Costs no points.
Source: dns
Registration
From the registry's RDAP service.
PassRegistration
Registered 2009, renews in 211 days. No registry hold.
Source: rdap
How to read it
- Unknown is never clean. Barracuda did not answer in this sample, so it is shown as Unknown and costs nothing, rather than being counted as a pass.
- Not checked means not checked. Spamhaus needs a commercial key; without one it is never queried, and the report says so.
- Shared servers are not your problem to carry. A Microsoft 365 or Google server sends for thousands of organizations, so its listings are never scored against you.
- The score is our summary. There is no universal Internet reputation score. This one is MailThreatZero's assessment of the signals shown, each with its evidence.
How protected domain reputation monitoring works
This report covers how a domain looks as a mail sender. For the rest of a customer's exposure — vulnerabilities, exposed services and identity, connected into attack paths — Exploit Hound does exposure management for MSPs, from the same operator.