Scoring criteria
This score describes observable controls at a point in time. It does not assess internal security, vulnerability exposure or Essential Eight compliance.
| CONTROL | POINTS |
|---|---|
| certificate | 20 |
| redirect | 10 |
| hsts | 7 |
| content security policy | 3 |
| framing | 2 |
| x content type options | 2 |
| referrer policy | 1 |
| spf | 15 |
| dmarc | 25 |
| dnssec | 10 |
| security txt | 5 |
Website controls · 45 points
We inspect both apex and www endpoints. Each control averages its applicable endpoints, so a weaker hostname cannot be hidden by a stronger one. Certificates must be trusted, unexpired and hostname-valid on every measured HTTPS hop. HTTP must upgrade to trusted HTTPS within four redirects. HTTPS downgrades fail. Published redirects may delegate a website to another public hostname. We follow at most four redirects, validating and pinning each destination and verifying TLS on every HTTPS connection. Redirect destinations are measured only as part of that published chain and are not added as tracked domains.
HSTS earns full credit for one valid max-age of at least 180 days on every measured HTTPS hop; shorter positive durations earn half. Missing, duplicate, invalid or disabled max-age earns zero. Preload and includeSubDomains are not required.
Headers earn eight points: enforced CSP three, framing protection two, X-Content-Type-Options: nosniff two, and restrictive Referrer-Policy one. CSP earns full credit when structurally valid default/script sources exclude wildcards, unsafe-inline and unsafe-eval; another structurally valid enforced policy earns half. Report-only policies earn none. Framing accepts restrictive CSP frame-ancestors or X-Frame-Options DENY/SAMEORIGIN. Accepted referrer policies are no-referrer, same-origin, strict-origin and strict-origin-when-cross-origin. Permissions-Policy remains informational. Document headers are scored on successful HTML responses; restricted/error responses remain unknown where a control cannot be established. Transport HSTS headers remain measurable on restricted responses. Missing document headers on access-denied responses remain unknown. Header parsing cannot prove application-level effectiveness.
Email controls · 40 points
SPF contributes 15 points. Structurally valid -all earns full credit, ~all 75%, neutral/default-neutral 25%, and unrestricted +all zero. A valid symbolic terminal redirect earns half. Static includes and redirects are checked within recursion and lookup safeguards; sender-dependent macro branches are syntax-checked without inventing sender information. Include fallbacks do not determine the root policy’s restrictiveness. Genuine DNS failures are unknown; malformed or missing policies fail.
DMARC contributes 25 points: fully enforced reject earns 25, quarantine 20 and monitoring five. A valid legacy pct scales enforcement credit above the monitoring baseline; testing mode caps credit at five. Missing, duplicate and invalid policies earn zero. We inspect the explicit apex policy. No test email is sent or DKIM selector guessed. Null MX declares no inbound mail; it does not exempt anti-spoofing controls.
DNSSEC · 10 points
A validating resolver’s authenticated SOA answer earns full credit. Authenticated DS absence, or a validating resolver’s accepted NSEC3 opt-out denial beneath a validated signed parent, establishes unsigned delegation and earns zero. We follow ancestor delegations where necessary. Explicit DNSSEC-bogus responses earn zero. A validating resolver reporting a nonexistent domain also earns zero because no DNSSEC-enabled domain is available. Other SERVFAIL responses and inconclusive validation remain unknown. Transient native DNS failures receive one bounded HTTPS resolver fallback; resolver errors are never treated as absent records. We use HTTPS to the validating resolver and retain selected validation metadata.
security.txt · 5 points
Each applicable hostname is checked at /.well-known/security.txt over trusted HTTPS, including published cross-host redirects to a delegated file. Its final retrieval host is recorded; a shared file does not prove common ownership. Full credit requires UTF-8 text/plain, valid field syntax, contact URIs, exactly one future Expires timestamp and matching Canonical declarations when present. Missing, expired or invalid files earn zero; measurement failures are unknown. Inspection is capped at 32 KiB, 1,000 lines and four in-scope redirects. Signatures and contact ownership are not verified. Raw file bodies and contact values are discarded.
Applicability and unknown results
Only confirmed absence of both A and AAAA records makes a hostname inapplicable. If both hostnames lack addresses, website and disclosure controls are excluded. Refused connections, timeouts, invalid TLS and blocked destinations do not prove an unused service. Email and DNS controls always apply. Points are normalised against applicable controls, with the denominator and profile published in each report.
A numeric overall score requires every applicable scored measurement to be determinate. Unknown is never silently converted to failure. Incomplete scans retain the previous complete score, timestamp. Category scores can still be available independently.
History and comparison
Historical scores retain the criteria used when measured. The posture trend starts once every currently tracked domain has a measurement using the current criteria. Thereafter, immutable weekly snapshots are taken each Monday at 00:00 UTC. Each snapshot uses the latest measurement from the preceding week; unknown numeric scores are excluded from the average and recorded separately. Averages compare domains with all scoring categories applicable. Changes in the tracked population can affect averages.
Scan boundaries and performance
Automatic scans run once every seven days after the previous measurement, including incomplete results. Newly tracked domains are eligible immediately. Overdue domains and first measurements are processed as quickly as capacity permits; administrators can explicitly request an earlier rescan. Attempts that produce no measurement may retry. Scans use bounded parallel jobs and DNS queries, scan-local DNS deduplication, shared per-host pacing and a 120-second deadline. Every destination and redirect is validated and pinned to public addresses before connecting. There is no fixed daily scan quota. Request pacing, retries and redirects remain bounded. Reports expose duration and request counts; timeout-expired measurements remain unknown.
Probes begin only at apex and www; explicitly published redirect destinations may also be inspected within the same bounded request chain. We do not enumerate ports, exploit services or crawl page bodies. Selected DNS answers, certificate metadata and headers are retained. Detailed evidence expires after 90 days and measurements after 12 months.
When a web probe receives HTTP 403, one bounded retry may use a separate Cloudflare network path. The retry starts from the original URL and retains public-address pinning, certificate verification and request limits. Reports identify controls measured through this fallback. Requests still restricted or otherwise unobservable remain unknown; an alternate network does not guarantee access.
Discovery and corrections
Common Crawl, daily Tranco top one million, registry imports and DNS-validated administrator submissions discover registrable .au domains. Coverage is incomplete and not statistically representative of Australia. Domains remain tracked when they leave discovery lists. Owners can request DNS-verified exclusions and submit documented corrections.