Reputation Score

What it is

The Reputation Score is a 0–100 number and an A–F grade for how your organization looks from the outside: your domains' DNS and e-mail authentication, the certificates your sites present, the reputation and open services of your addresses, and lookalike domains or certificates someone else registered in your name. It uses only the evidence CMDash's own checks collected, so every point you lose points at a specific finding you can fix — and you can rebuild the number yourself from this page.

SecurityScorecard and Bitsight ratings, if you have them connected, are shown beside the score and never mixed into it: their formulas aren't public, so blending them would make ours impossible to check.

The /exposure page is the Exposure overview: the score and its top drivers sit above panels for your external ratings, lookalike-domain triage, certificate-transparency findings and TLS health — one screen for what Domain Posture and IP Reputation each track in depth.

When to use it

Open it to see which fixes move your number most — the explanation lists every lost point, largest first. Use the trend to show improvement over time. If you share the score with customers, share this page with it: it is the methodology.

Before you start

How to

Step 1 — the posture percentage

100 points are split across four areas:

Domains. With several verified domains, your primary domain holds 60% of the DNS and TLS points and the others share the remaining 40% equally. One domain holds all of it; if your primary isn't verified, all domains share equally. Addresses share the IP and exposed-services points equally.

Inside a domain or address, points are split by weight:

• DNS checks by severity: critical 4, high 3, medium 2, low 1. Informational and not-applicable checks aren't graded — the same weights as your domain grade.
• TLS hosts: apex 2, www 2, mail host 1.
• IP sources: Spamhaus ZEN 5; SpamCop, AbuseIPDB and GreyNoise 3 each; Mailspike, PSBL, GBUdb Truncate and blocklist.de 2 each; UCEPROTECT Level 1 is 1. A source that isn't configured for you (Spamhaus without your key), or doesn't support the address type (the free blocklists are IPv4-only), isn't counted at all.
• Exposed services: one result per address. Pass: nothing open, or only 25, 53, 80, 110, 143, 443, 465, 587, 853, 993 or 995. Fail: any CVE Shodan tags, or any of 21, 23, 111, 135, 139, 445, 1433, 1521, 2375, 3306, 3389, 5432, 5900, 5985, 5986, 6379, 9200, 11211 or 27017. Warn: any other open port, such as 22 or 8080.

A pass (or clean) earns all of its points, a warning half, a fail (or listing) none.

"Could not check" is left out of both sides. A result that timed out or was refused is removed from the points earned and the points possible, so it neither helps nor hurts:

posture = 100 × points earned ÷ points possible among the results that answered

Evidence rule. Each result uses the newest real answer from the last 7 days. A refused lookup today doesn't erase yesterday's listing, and anything older than 7 days counts as "could not check".

Insufficient data. There is no number and no grade unless at least 60% of the possible points answered (the same bar as the domain grade), and at least two of the four areas answered. DNS and TLS always count toward what's possible — with no verified domain, you can't reach 60% on addresses alone.

Step 2 — threat deductions

Deductions come off the posture percentage. Finding nothing never earns points.

• Lookalike domains still registered and triaged Suspicious (the default) or Takedown Requested: −4 each if the domain can receive mail, −1 if not, at most −12 in total (shared proportionally beyond that). Benign and Ours cost nothing. Takedown Requested keeps costing until the domain stops resolving, because filing a request doesn't stop a live phishing site.
• Certificates found in certificate-transparency logs that are still valid and come from an issuer your CAA record doesn't allow: −2 each, at most −6. The issuer match compares free text, so it stays small.

The score can't go below 0.

Step 3 — caps

A few findings are serious enough that good results elsewhere mustn't hide them:

Verifying more clean domains can't average a cap away.

Step 4 — rounding and grade

The result is rounded to a whole number. A is 90 and up, B 80–89, C 70–79, D 60–69, F below 60.

Reading the explanation

Every point between 100 and your score belongs to one finding, for example "−9: DMARC policy quarantines or rejects at 100% — failed on acme.com". A finding's points are its share of the posture loss (its unearned points ÷ all points that answered × 100), plus its deduction, plus its share of a cap. When several findings set the same cap, they split it equally. Whole points are shared out by largest remainder, so the list always adds up to exactly 100 minus your score.

Worked example

One verified domain with six graded checks (weights 4+4+4+3+3+2 = 20), all passing except DMARC policy (critical, 4); apex and www certificates fine; one address clean on every source with only 443 open; one suspicious lookalike with MX. Everything answered, so all 100 points count. DMARC loses 4 ÷ 20 of the 45 DNS points = 9. Posture 91, minus 4 = 87, B; the explanation shows −9 and −4.

Had DNSSEC and CAA (weights 3 and 2) timed out instead, 5 ÷ 20 × 45 = 11.25 points leave both sides: posture = 100 × (88.75 − 9) ÷ 88.75 = 89.86, minus 4 = 85.86, so 86, B. DMARC now shows −10.

Common questions

Why did fixing something not change my score? A cap may still apply (fix the capped finding first), a deduction total may still be at its maximum, or the change was under half a point and rounding absorbed it. Fixing something never lowers the score.

Why "insufficient data" when my domain is verified? Its first scans may not have run yet, or too many checks couldn't be answered this week — the page shows how much answered.

Can I raise the score by marking lookalikes Benign? Yes, and that's intended — but mark only registrations you've actually reviewed. Your triage choices are recorded against your name.

Why isn't my SecurityScorecard/Bitsight rating included? Their methods aren't published, so we show them next to the score rather than inside it.

Related

• Domain Posture (DNS & E-mail Security)
• IP Reputation
• Vendors (TPRM) & Questionnaires