Health grade — the A–F score for every domain
The health grade rolls all of a domain's checks into one number you can act on. Fourteen automated checks across six categories each get a weight; Domain Watchdog re-scores every domain daily and turns the result into a 0–100 score and an A–F letter. It's the same engine that powers the free /check page — the paid product just runs it every day on every domain you monitor.
The grade is the headline for each domain. It comes from 14 automated checks across 6 categories — Certificates & TLS, Email authentication, Web security, Indexability, DNS, and Reputation. Each check is weighted by how much it matters (a certificate about to expire counts far more than a missing DNSSEC signature), and the weighted results become a 0–100 score that maps to a letter: A is 90 or above, B is 80–89, C is 70–79, D is 60–69, and anything below 60 is an F.
Each check returns one of a few verdicts, and the verdict decides how it counts. A pass earns the check's full weight, a warning earns half, and a fail earns zero but still counts against the total — so a real problem pulls the score down. The important part is what happens when a check can't run: if a check errors out or doesn't apply, it's excluded from the math entirely, from both the top and the bottom of the fraction. The score only ever reflects what Domain Watchdog could actually check, and a probe that failed for our reasons never lowers your grade.
Because checks can be excluded, each domain shows a coverage line — “{checked}/{total} checked” — so you can see how much of the picture the grade is based on. The score itself is the earned weight divided by the possible weight, times 100, rounded to the nearest whole number.
A grade of “NA / Not scored” is not the same as an F. If nothing on a domain could be scored, Domain Watchdog shows NA rather than punishing the domain with an F it didn't earn. A brand-new domain you just added shows “Not yet scanned” until its first daily scan runs.
An error is not a fail. If a check can't complete — a network timeout, a service that didn't answer — it's set aside and left out of the score, never counted as a failure. Your grade reflects genuine problems on the domain, not hiccups in the checking.
If you turn a check off for a domain, it's excluded from the grade exactly the same way an inapplicable check is — it drops out of both the earned and possible totals, so a disabled check never counts as a fail or drags the score down.
Frequently asked questions
What makes up the grade?
14 automated checks across 6 categories — Certificates & TLS, Email authentication, Web security, Indexability, DNS, and Reputation. Each check is weighted, the weighted results become a 0–100 score, and the score maps to a letter: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, otherwise F.
How often is the grade recalculated?
Every day. Domain Watchdog re-runs all the checks on every domain you monitor once per day and re-scores it, so the grade always reflects the domain's current state — not how it looked when you added it.
Why does a domain show NA instead of a letter?
“NA / Not scored” means nothing on the domain could be scored — so rather than hand out an F it didn't earn, Domain Watchdog shows NA. A brand-new domain shows “Not yet scanned” until its first daily scan completes. Both are deliberately different from F.
Does a failed check lower my grade the same as a real problem?
No. A check that fails counts as zero but still counts against the total, so a real problem lowers the score. A check that errors out or doesn't apply is excluded from the math entirely — from both the earned and possible totals — so it never lowers the grade. The coverage line shows how many checks the grade is actually based on.