A score is a checklist, not a promise
InboxMonitor gives every domain a number from 0 to 100 and a label: Healthy, Watch, or At risk. The number is not a prediction that mail will reach the inbox. The product does not measure placement, bounces, or replies. The score only reflects the checks that ran.
The check starts at 100. Each finding that matters subtracts a fixed number of points. Info notes usually do not. The result stays between 0 and 100. The label comes from the kinds of findings, not from a separate opinion.
How the label is chosen
Healthy means the status in the code is green. That happens only when there is no critical finding, no warning finding, and the score is 85 or higher. A clean record can still carry info notes, such as a reminder that HELO names cannot be checked from DNS alone.
Watch is the yellow label. It is used when there is at least one warning, or when the score is under 85, and there is no critical finding and the score is not under 60. A warning forces Watch even if the number is still high. DMARC at p=none is a warning and costs 10 points, so a domain that is otherwise tidy often sits at 90 and Watch.
At risk is the red label. It is used when any finding is critical, or when the score is under 60. A single critical issue is enough. Missing SPF, an SPF record that does not parse, more than 10 SPF lookups, SPF ending in +all, a missing DMARC record, a DMARC record that does not parse, DKIM selectors you saved that did not resolve, and a blocklist hit are critical. Several warnings can also push the score under 60 with no critical issue, and that is At risk too.
What subtracts points
SPF is the largest authentication group. No SPF record costs 30. An SPF record that does not parse costs 28. More than 10 DNS lookups costs 25. Ending in +all costs 22. Ending in ?all, or having no all mechanism, costs 8. A lookup that does not finish costs 6. Using 8, 9, or 10 lookups, still inside the limit, costs 6 because the next include can tip it over.
DKIM only lowers the score in specific cases. No key at the usual selectors is an info note and costs nothing when you have not saved a custom selector. Selectors you saved that do not resolve cost 24. A revoked selector (an empty p= tag) costs 8 only when no other key is live. An RSA key under 1024 bits costs 16. A 1024-bit key is an info note and does not lower the score. The note still says 2048 is the size to publish next.
DMARC missing costs 24. A DMARC record that does not parse costs 16. A lookup that does not finish costs 4. A valid record with p=none costs 10 and is a warning, which is why it shows as Watch. A valid record with no rua= address costs 2. That one is filed as info, so by itself it does not flip the label, but it does lower the number. MX missing costs 8. An MX lookup that does not finish costs 4.
Blocklist math is separate. Each listed address on a list that is actually queried counts. The first listing costs 30, and each extra listing costs 5 more, up to a cap of 40. A policy-list note does not subtract points. A refusal, a timeout, or an error is not treated as clean and is not treated as a listing, so it does not change the score. By default the check queries PSBL and 0spam. Spamhaus is not included unless a paid key is configured, and several other lists stay off until they are turned on.
A missing PTR costs 8. A PTR name that does not resolve back to the same address costs 6. Addresses behind shared Google or Microsoft includes are skipped. Domain age under 7 days costs 12. From 7 days up to 30 days costs 6. Age is a warning about new domains, not a placement measurement.
What to do with Watch
Open the domain and read the warning lines first. Watch means something is unfinished, not that sending must stop. The usual case is p=none, a soft or missing all mechanism, no MX on a domain that should accept replies, a PTR gap, a young domain, or SPF lookups in the 8 to 10 range. Fix the one the page names. Run the check again. If the warning is gone and nothing critical remains, the label can return to Healthy on the next result.
Do not delete a record you still send through just to raise the number. Change the record so it matches how you send, then recheck.
What to do with At risk
At risk means a critical finding or a score under 60. Start with the critical line. A missing SPF or DMARC record, a broken record, +all, too many SPF lookups, or a blocklist hit will not clear because you tidy a smaller warning. Publish or repair that record, or deal with the list operator if an address is listed. Then recheck. If several warnings alone pushed the score under 60, fix the largest costs first: missing MX, a very new domain, p=none, a short DKIM key, and PTR.
InboxRescue Audit is a one-time written report of these same checks, with the records to publish. It does not promise inbox placement, a reputation change, or removal from a blocklist. InboxMonitor is the ongoing watch: the free plan covers 3 domains, checks daily, and emails you when a result gets worse.