What a score means
The public-signal score describes observable DNS and website controls at a point in time. It is not an assessment of overall organisational security, internal systems, vulnerability exposure or Essential Eight compliance. Missing controls are opportunities to investigate, not proof of compromise.
Scoring · public-signals-2
The apex domain contributes to a 100-point score. The www hostname is inspected separately for context. Each check awards all, half or none of its points; unknown measurements withhold the overall score.
| CONTROL | POINTS | CRITERIA |
|---|---|---|
| HTTPS certificate | 30 | Trusted certificate, valid dates and matching hostname. |
| HTTP upgrade | 15 | HTTP reaches trusted HTTPS on the apex or www within four redirects. Later external redirects are not followed. No credit for a downgrade. |
| SPF | 20 | One policy passing supported structural and include/redirect checks, within ten lookup terms, ending in -all or ~all. Half credit for a structurally valid permissive or neutral policy. |
| DMARC | 25 | One valid policy with p=quarantine or p=reject and full enforcement. Half credit for monitoring, t=y testing mode, or a legacy pct below 100. |
| HSTS | 10 | A positive max-age on the first trusted HTTPS response, including a redirect response. |
Unavailable websites receive zero for determinate unavailable web checks. This means mail-only domains can have low web scores. Read individual categories before comparing domains.
Unknown is not a failure
Timeouts, blocked destinations, redirects outside scope are unknown. All five scored checks must have determinate results to publish a numeric score. Incomplete scans retain the last complete score and its date, clearly marked as previous.
SPF macros
Version 2 validates RFC 7208 macro syntax, transformations, delimiters and context. Domain-derived macros such as %{d} are expanded to validate static include and redirect chains. Sender-dependent branches are retained symbolically and are not queried without sender context. A valid symbolic branch alone does not make the measurement unknown. Restrictive -all or ~all policies receive full SPF credit; structurally valid neutral or permissive policies receive half. Unresolved symbolic redirects receive half credit. Genuine resolver errors remain unknown, and malformed syntax fails. This is policy analysis, not an email delivery simulation.
RFC 7208 macro specification · Tranco source and methodology
security.txt
Each apex and www host is checked independently at /.well-known/security.txt over trusted HTTPS. This informational check validates UTF-8 text/plain, field syntax, Contact URIs, a single unexpired Expires timestamp, and matching Canonical declarations when present. Inspection is capped at 32 KiB, 1,000 lines and four redirects within the apex/www scope. External redirects and incomplete measurements remain unknown. Signatures and contact ownership or reachability are not verified. Contact values and raw file contents are discarded; only validation metadata is retained. Existing reports acquire this check on their next scan. It does not change the score.
RFC 9116 security.txt specification
Additional observations
We record public A, AAAA, MX, NS and CAA answers, a validating resolver’s DNSSEC signal, HTTPS status, certificate expiry and selected security headers. These do not add score points. DMARC checks cover the explicit apex policy; inherited parent policy discovery is outside this version. Header presence alone does not prove effectiveness. SPF evaluation is structural and cannot establish whether every legitimate sender is authorised; no test email is sent and DKIM selectors are not guessed.
Coverage and comparability
.au domains are discovered from public sources, imports and submissions. New intake accepts only registrable .au names. Sources include Common Crawl, the daily standard Tranco top one million, registry imports and validated public submissions. Existing tracked domains are retained. Discovery is incomplete, and the admitted sample is not statistically representative of Australia.
Weekly scans build domain history; daily aggregates use each domain’s most recent complete score from the preceding seven days. Aggregates compare only public-signals-2 scores; historical version 1 scores remain labelled and are excluded from these comparisons. Changing sample membership can change the average. Trends are observational and do not establish cause.
Measurement boundaries
Only the apex and www websites are requested. Redirects outside those hosts are recorded as outside scope. We do not scan ports, crawl website content, send email or attempt exploitation. Website bodies and cookies are discarded. A bounded security.txt body is inspected temporarily in memory and discarded after validation. Selected evidence expires after 90 days; measurement history expires after 12 months.