The findings at a glance
- Loading the latest snapshot…
Results
Posture overview
DMARC
Published policy
Over time
DMARC enforcement
Historical trend appears after more snapshots are collected.
Over time
SPF terminal policy
SPF policy history appears after more snapshots are collected.
DNSSEC
Email DNS chain states
Inferred services
Inbound mail (MX)
Top services matched from MX hostnames. A domain can match more than one.
Inferred services
Outbound senders (SPF)
Top services matched from SPF include and redirect targets.
Limited web sample
Root HEAD and security.txt
Domain explorer
Inspect domain signals
Ranks show global Tranco placement and position within the current .au subset. Open a row for the email evidence and the limited security.txt request observations.
| Rank | Domain | SPF | DMARC | Web | |
|---|---|---|---|---|---|
| Loading the public snapshot… | |||||
No scan data yet
Run the Refresh .au security data and publish Pages workflow from the Actions tab to create the first snapshot.
Methodology
The collector runs weekly. It downloads the Tranco top one million, keeps every exact .au name (including subdomains), and checks the union of those names and all names tracked in earlier scans. A name that falls out of the top million stays tracked and is shown as >1,000,000.
Email and DNS
For each name the collector records SPF, DMARC, MX, MTA-STS, SMTP TLS reporting, nameservers, SOA and the DNSSEC chain. DNS errors stay distinct from absent and malformed records. DKIM selectors are not probed because a domain's selector set cannot be discovered comprehensively.
Likely mail services
Services are inferred from role-specific hostname matches: outbound clues use SPF include and redirect targets, inbound clues use MX hosts, and reporting clues use DMARC or TLS-RPT destinations. Unmatched hostnames remain Unclassified. These clues describe published configuration; they do not confirm actual message traffic.
Root HEAD and security.txt
Before the security.txt request the collector makes a bodyless HEAD /, follows redirects, and records whether that chain upgrades to HTTPS plus selected headers including HSTS. It then GETs only/.well-known/security.txt over HTTP, trying HTTPS only if HTTP fails before returning a response. Format validity, expiry freshness, redirects and certificate validity are reported independently. Response bodies and certificate details are processed in memory and discarded.
SPF · RFC 7208DMARC · RFC 9989security.txt · RFC 9116Tranco ranking
Limitations
- Popular names only. The scope is .au names in Tranco's top million plus names retained from earlier scans. It is not every registered .au domain.
- Configuration, not behaviour. Records show what is published at scan time. They do not measure message-level pass rates, spoofing exposure or exploitability.
- Provider labels are inferences. A matching hostname suggests a service; it does not prove traffic flows through it.
- The web sample is narrow. One
HEAD /and one security.txt request per name. HEAD results do not model browser-cached HSTS or client-side upgrades. - No signature verification. Signed security.txt structure is checked but signatures are not cryptographically verified.
- One scan per week. Short-lived DNS or network failures appear as lookup errors rather than being retried over days.
- No single score. Findings are reported per signal and not combined into a site-wide security rating.
Reproduce it
The collector code is available at github.com/emdashcyber/dmarc-au.