Independent Security Assessment

Domain & Email
Security Assessment

A comprehensive security audit of meridiandefence.com.au covering email authentication, DNS infrastructure, web security headers, compliance alignment, and threat intelligence.

Domain

meridiandefence.com.au

Assessment Date

6 March 2026

Document ID

MDS-SEC-2026-002

Scan Mode

Deep Scan

Classification

CONFIDENTIAL

Security Scorecard

01 — Overview

Executive Summary

High-level findings and risk assessment for meridiandefence.com.au

Meridian Defence Systems demonstrates a strong external security posture befitting a DISP-approved defence contractor. Email authentication is excellent with SPF hardfail, DKIM on three selectors, and DMARC reject policy — placing Meridian in the top tier of Australian defence industry organisations. Web security headers are comprehensive with a well-configured CSP, HSTS preload, and all critical headers present. The primary areas for improvement are the absence of DANE/TLSA records for SMTP transport encryption, no BIMI implementation for brand verification, and a mobile PageSpeed score that falls below optimal thresholds. With 16 findings identified (0 critical, 2 high, 5 medium, 5 low, 4 informational), the organisation's security posture aligns well with DISP membership requirements and Essential Eight ML2 aspirations.

Total Findings

Critical + High

TLS 1.3

TLS Version

Expires 2026-09-15

Custom

Platform

Critical

High

Medium

Low

Info

Secure Configuration Verified

The following areas demonstrate excellent security posture and meet or exceed industry best practices:
Email Security: A (92%)
Web Security: A (89%)
DNS & Infrastructure: A (90%)
MITM Resilience: A (91%)

Quick Wins

Submit meridiandefence.com.au to the HSTS preload list at hstspreload.org (5 minutes, after subdomain HTTPS audit)
Add BIMI DNS record with SVG logo for email brand verification (30 minutes)
Increase MTA-STS max_age from 7 days to 1 year (5 minutes)
Add missing CSP directives: object-src 'none'; media-src 'self'; worker-src 'self' (15 minutes via Cloudflare)
Add PGP encryption key to security.txt for encrypted vulnerability disclosures (30 minutes)

ID	Finding	Severity	Status
`MDS-001`	DANE/TLSA Records Not Configured for Email Transport	High	Open
`MDS-002`	Mobile PageSpeed Performance Below Threshold	High	Open
`MDS-003`	BIMI Record Not Configured	Medium	Open
`MDS-004`	CSP Contains 'unsafe-inline' for Scripts	Medium	Open
`MDS-005`	Missing CSP Directives: object-src, media-src, worker-src	Medium	Open
`MDS-006`	HSTS max-age Meets Minimum but Preload Not Yet Active	Medium	Open
`MDS-007`	Subdomain Exposure — 12 Subdomains Discovered	Medium	Open
`MDS-008`	MTA-STS Policy max_age Below Recommended Value	Low	Open
`MDS-009`	security.txt Missing Encryption Key Field	Low	Open
`MDS-010`	Cookie SameSite Attribute Set to 'Lax' Instead of 'Strict'	Low	Open
`MDS-011`	X-XSS-Protection Header Set to '0'	Low	Open
`MDS-012`	Certificate Transparency Shows Multiple Issuers	Low	Open
`MDS-013`	DNSSEC Enabled — Strong DNS Integrity	Info	Open
`MDS-014`	Email Authentication Fully Configured — SPF, DKIM, DMARC at Maximum Enforcement	Info	Open
`MDS-015`	MTA-STS Enforce Mode Active with TLS-RPT Reporting	Info	Open
`MDS-016`	Comprehensive Security Headers — 8 of 9 Headers Present	Info	Open

02 — Scope & Methodology

Assessment Scope

What was tested, how, and what limitations apply

In Scope

✓ DNS records & configuration
✓ Email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE)
✓ HTTP security headers
✓ SSL/TLS configuration
✓ DNSBL / blacklist checking
✓ SMTP analysis
✓ OSINT & historical intelligence
✓ Compliance framework alignment

Out of Scope

✗ Application security testing
✗ Penetration testing
✗ Source code review
✗ Social engineering
✗ Internal network assessment

Methodology Note

This assessment was performed using publicly available information only. No intrusive testing was conducted. Scan timestamp: 2026-03-06T09:15:22Z. Mode: Deep Scan.

03 — Findings

Detailed Findings

16 findings identified, sorted by severity.

MDS-001High4.8/10 High

DANE/TLSA Records Not Configured for Email Transport

No DANE/TLSA records found for MX endpoints. DANE (DNS-based Authentication of Named Entities) provides cryptographic assurance that SMTP connections use the correct TLS certificate, preventing man-in-the-middle attacks on email delivery. For a defence contractor handling sensitive communications, DANE adds a critical layer of transport security beyond opportunistic TLS.

Likelihood

Impact

Evidence

MX: meridiandefence-com-au.mail.protection.outlook.com
TLSA lookup: _25._tcp.meridiandefence-com-au.mail.protection.outlook.com → No records

Note: Microsoft 365 does not natively support DANE for inbound mail. DANE for SMTP is supported for outbound connections only as of March 2024.

Remediation

Netier Recommendation: While Microsoft 365 does not support inbound DANE, configure outbound DANE validation in Exchange Online via PowerShell:

Set-TransportConfig -DnsSec Enabled

For full DANE compliance, consider deploying a dedicated MTA gateway (e.g., Sophos Email Gateway) in front of Exchange Online that supports TLSA records. Netier can architect and deploy this as part of the Email Security Enhancement service.

ISM-1026 ISM-1589 CIS 9.5 PSPF INFOSEC-11NIS2-Art21.2h

MDS-002High3.6/10 Medium

Mobile PageSpeed Performance Below Threshold

Mobile Lighthouse performance score of 72/100 falls below the recommended 80+ threshold. Largest Contentful Paint (LCP) of 3.2s exceeds the 2.5s 'good' threshold, and Total Blocking Time (TBT) of 180ms indicates JavaScript execution issues on mobile devices. Poor mobile performance can impact user engagement and may indicate unoptimised assets being served to mobile clients.

Likelihood

Impact

Evidence

Mobile Lighthouse Scores:
  Performance: 72 (threshold: 80+)
  LCP: 3.2s (threshold: ≤2.5s)
  TBT: 180ms (threshold: ≤200ms — marginal)
  CLS: 0.08 (threshold: ≤0.1 — passing)
  Speed Index: 3.5s (threshold: ≤3.4s — marginal)

Desktop Performance: 88 (passing)

Remediation

Netier Recommendation: Engage Netier's Web Performance Optimisation service to:
1. Implement lazy loading for below-fold images and iframes
2. Defer non-critical JavaScript execution (reduce TBT)
3. Serve WebP/AVIF images via Cloudflare Polish (already on Cloudflare)
4. Enable Cloudflare Rocket Loader for JavaScript optimisation
5. Configure Cloudflare Image Resizing for responsive images

Estimated improvement: 72 → 85+ with Cloudflare optimisations alone.

OWASP A05-2021ISO A.8.26

MDS-003Medium2.4/10 Medium

BIMI Record Not Configured

No Brand Indicators for Message Identification (BIMI) record found. BIMI displays your organisation's verified logo in supporting email clients (Apple Mail, Gmail, Yahoo), increasing brand trust and helping recipients identify legitimate emails. For a defence contractor, BIMI provides visual authentication that complements technical email security controls.

Likelihood

Impact

Evidence

DNS lookup: default._bimi.meridiandefence.com.au → No records

Prerequisites met:
  ✓ DMARC p=reject (required for BIMI)
  ✓ DKIM signing active (required for BIMI)
  ✗ VMC (Verified Mark Certificate) — required for Gmail/Apple Mail logo display

Remediation

Netier Recommendation: Implement BIMI in two phases:

Phase 1 (Immediate, 30 min):
  Add DNS TXT record: default._bimi.meridiandefence.com.au
  Value: v=BIMI1; l=https://meridiandefence.com.au/.well-known/logo.svg
  Host the SVG logo in Tiny PS format at the specified URL.

Phase 2 (2-4 weeks):
  Obtain a Verified Mark Certificate (VMC) from DigiCert or Entrust.
  Cost: ~$1,500 AUD/year. Requires a registered trademark.
  Update BIMI record: v=BIMI1; l=<svg-url>; a=<vmc-url>

Netier can manage the VMC procurement and DNS configuration as part of the Email Security service.

ISM-0269 PSPF INFOSEC-3

MDS-004Medium3.6/10 Medium

CSP Contains 'unsafe-inline' for Scripts

The Content Security Policy allows 'unsafe-inline' in the script-src directive. While the CSP is otherwise well-configured with explicit source restrictions, 'unsafe-inline' weakens protection against Cross-Site Scripting (XSS) attacks by permitting inline JavaScript execution.

Likelihood

Impact

Evidence

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.meridiandefence.com.au; ...

Present directives: default-src, script-src, style-src, img-src, font-src, frame-ancestors, base-uri, form-action, upgrade-insecure-requests
Missing: object-src, media-src, worker-src

Remediation

Netier Recommendation: Replace 'unsafe-inline' with CSP nonces or hashes:

1. Generate a random nonce per request in the application server
2. Add nonce to CSP header: script-src 'self' 'nonce-{random}' https://cdn.meridiandefence.com.au
3. Add nonce attribute to all inline <script> tags: <script nonce="{random}">
4. Add missing directives: object-src 'none'; media-src 'self'; worker-src 'self'

Netier's Web Application Security team can implement this during the next scheduled maintenance window.

ISM-1488 OWASP A03-2021 CIS 16.11ISO A.8.26

MDS-005Medium2.4/10 Medium

Missing CSP Directives: object-src, media-src, worker-src

The Content Security Policy is missing explicit directives for object-src, media-src, and worker-src. While default-src 'self' provides a fallback, explicitly defining these directives ensures defence-in-depth and prevents unintended resource loading from the default source.

Likelihood

Impact

Evidence

Current CSP directives (9): default-src, script-src, style-src, img-src, font-src, frame-ancestors, base-uri, form-action, upgrade-insecure-requests

Missing (3): object-src, media-src, worker-src

Recommended additions:
  object-src 'none' — blocks Flash/Java plugins
  media-src 'self' — restricts audio/video sources
  worker-src 'self' — restricts service worker origins

Remediation

Netier Recommendation: Add the missing directives to the Cloudflare Transform Rule or application header configuration:

object-src 'none'; media-src 'self'; worker-src 'self'

This is a low-risk, high-value change that can be deployed via Cloudflare dashboard without application changes. Netier can implement this within a standard change window (15 minutes).

ISM-1488 ISM-1489 CIS 16.11

MDS-006Medium2.4/10 Medium

HSTS max-age Meets Minimum but Preload Not Yet Active

HSTS is configured with max-age=31536000 (1 year), includeSubDomains, and preload directive. However, the domain is not yet on the Chromium HSTS preload list, meaning first-time visitors are still vulnerable to SSL stripping attacks until the browser caches the HSTS policy.

Likelihood

Impact

Evidence

strict-transport-security: max-age=31536000; includeSubDomains; preload

HSTS Preload Status: Not on preload list
Preload requirements met:
  ✓ max-age ≥ 31536000
  ✓ includeSubDomains present
  ✓ preload directive present
  ✗ Submitted to hstspreload.org

Remediation

Netier Recommendation: Submit meridiandefence.com.au to the HSTS preload list:

1. Visit https://hstspreload.org
2. Enter meridiandefence.com.au
3. Confirm all subdomains support HTTPS (verify: autodiscover, mail, portal, vpn, intranet, dev, staging)
4. Submit for inclusion

Processing time: 2-4 weeks for list inclusion, then distributed via browser updates.

⚠️ WARNING: Preload is permanent. Ensure ALL subdomains serve valid HTTPS before submitting. Netier should audit all 12 known subdomains first.

ISM-1373 ISM-1554 PSPF INFOSEC-7

MDS-007Medium3.2/10 Medium

Subdomain Exposure — 12 Subdomains Discovered

Certificate Transparency logs and DNS enumeration revealed 12 subdomains. While most appear to be standard Microsoft 365 auto-configuration records, subdomains like 'dev', 'staging', 'intranet', and 'vpn' may expose internal infrastructure or development environments if not properly secured.

Likelihood

Impact

Evidence

Discovered subdomains (12):
  www, mail, autodiscover, sip, lyncdiscover,
  enterpriseregistration, enterpriseenrollment,
  portal, vpn, intranet, dev, staging

High-interest subdomains:
  dev.meridiandefence.com.au — Development environment
  staging.meridiandefence.com.au — Staging environment
  intranet.meridiandefence.com.au — Internal portal
  vpn.meridiandefence.com.au — VPN gateway

Remediation

Netier Recommendation:
1. Verify dev/staging are behind Cloudflare Access (Zero Trust) — restrict to Netier and Meridian IP ranges
2. Ensure intranet is not publicly accessible — should resolve to internal IP only or be behind Zero Trust
3. Review VPN endpoint hardening (certificate-based auth, MFA)
4. Consider removing dev/staging from public DNS if they're internal-only (use split-horizon DNS)

Netier can configure Cloudflare Access policies for all sensitive subdomains as part of the Zero Trust deployment.

ISM-1580 ISM-1710 CIS 12.1

MDS-008Low1.2/10 Low

MTA-STS Policy max_age Below Recommended Value

The MTA-STS policy file specifies max_age=604800 (7 days), which is below the recommended minimum of 2592000 (30 days). A shorter max_age means sending MTAs cache the policy for less time, increasing the window during which a downgrade attack could succeed if the policy becomes unavailable.

Likelihood

Impact

Evidence

MTA-STS Policy:
  version: STSv1
  mode: enforce
  mx: meridiandefence-com-au.mail.protection.outlook.com
  max_age: 604800 (7 days)

Recommended: max_age ≥ 2592000 (30 days)
Best practice: max_age = 31557600 (1 year)

Remediation

Netier Recommendation: Update the MTA-STS policy file at https://mta-sts.meridiandefence.com.au/.well-known/mta-sts.txt:

version: STSv1
mode: enforce
mx: meridiandefence-com-au.mail.protection.outlook.com
max_age: 31557600

Update the DNS TXT record _mta-sts.meridiandefence.com.au with a new id value to trigger cache refresh.

This is a 5-minute change with no risk.

ISM-1589 ISM-1590

MDS-009Low0.8/10 Low

security.txt Missing Encryption Key Field

The security.txt file is present and well-structured but is missing the optional 'Encryption' field. For a defence contractor, providing a PGP/GPG public key allows security researchers to encrypt vulnerability disclosures, protecting sensitive findings during responsible disclosure.

Likelihood

Impact

Evidence

security.txt contents:
  Contact: security@meridiandefence.com.au
  Expires: 2027-03-06T00:00:00.000Z
  Preferred-Languages: en
  Canonical: https://meridiandefence.com.au/.well-known/security.txt
  Policy: https://meridiandefence.com.au/security-policy

Missing: Encryption field (PGP key URL)

Remediation

Netier Recommendation: Generate a dedicated GPG key for security disclosures and add to security.txt:

1. gpg --full-generate-key (RSA 4096, security@meridiandefence.com.au)
2. Export public key: gpg --armor --export security@meridiandefence.com.au > security-pgp.asc
3. Host at: https://meridiandefence.com.au/.well-known/security-pgp.asc
4. Add to security.txt: Encryption: https://meridiandefence.com.au/.well-known/security-pgp.asc

Estimated effort: 30 minutes.

ISO A.5.14PSPF GOVSEC-3

MDS-010Low1.6/10 Low

Cookie SameSite Attribute Set to 'Lax' Instead of 'Strict'

Session cookies use SameSite=Lax, which allows cookies to be sent on top-level GET navigations from external sites. While Lax is adequate for most applications, SameSite=Strict provides stronger CSRF protection by preventing cookies from being sent on any cross-site request.

Likelihood

Impact

Evidence

Cookie: meridian_session
  Secure: true ✓
  HttpOnly: true ✓
  SameSite: Lax (recommended: Strict for defence applications)
  Path: /
  Domain: meridiandefence.com.au

Remediation

Netier Recommendation: Update the session cookie configuration to use SameSite=Strict. Test thoroughly as Strict may break OAuth/SSO redirect flows.

If SSO redirects break with Strict, consider a dual-cookie pattern:
  - Session cookie: SameSite=Strict (primary authentication)
  - SSO redirect cookie: SameSite=Lax (temporary, short-lived)

Netier can implement and test this during the next application maintenance window.

ISM-1490 OWASP A01-2021

MDS-011Low0.4/10 Low

X-XSS-Protection Header Set to '0'

The X-XSS-Protection header is explicitly set to '0', disabling the browser's built-in XSS filter. While this is actually the current best practice (the XSS auditor in Chrome was removed in 2019 due to bypass vulnerabilities, and a strong CSP supersedes it), some compliance frameworks still check for this header.

Likelihood

Impact

Evidence

x-xss-protection: 0

Note: Setting to '0' is correct per modern security guidance:
  - Chrome removed XSS Auditor in v78 (Oct 2019)
  - Mozilla never implemented it in Firefox
  - The auditor could be weaponised for information leakage
  - CSP provides superior XSS protection

However, some automated scanning tools flag '0' as a finding.

Remediation

No action required. The current setting of '0' is correct and follows OWASP and Mozilla security guidance. The Content-Security-Policy header provides comprehensive XSS protection.

Note for compliance: If an auditor or scanner flags this, reference:
  - OWASP: 'The X-XSS-Protection header has been deprecated and should be set to 0'
  - MDN: 'Non-standard; Chrome removed the XSS Auditor in Chrome 78'

OWASP A03-2021

MDS-012Low0.8/10 Low

Certificate Transparency Shows Multiple Issuers

Certificate Transparency logs show certificates issued by both Let's Encrypt and DigiCert for this domain. While not inherently problematic, multiple certificate issuers can indicate inconsistent certificate management practices or certificates issued for different services (web vs. mail).

Likelihood

Impact

Evidence

CT Log Analysis:
  Total certificates logged: 47
  Certificate Issuers:
    - Let's Encrypt (web, wildcard — automated via Cloudflare)
    - DigiCert Inc (mail.meridiandefence.com.au — Exchange Online)

  Recent certificates:
    *.meridiandefence.com.au — Let's Encrypt (Jan 2026)
    meridiandefence.com.au — Let's Encrypt (Jan 2026)
    mail.meridiandefence.com.au — DigiCert (Nov 2025)

Remediation

No immediate action required. The dual-issuer pattern is expected:
  - Let's Encrypt: Cloudflare edge certificates (auto-renewed)
  - DigiCert: Microsoft 365 mail certificates (managed by Microsoft)

Netier Recommendation: Ensure CAA records restrict issuance to only these two CAs (already configured ✓). Monitor CT logs via https://crt.sh/?q=meridiandefence.com.au for unexpected issuances.

ISM-1374 ISM-1553

MDS-013Info0.0/10 Low

DNSSEC Enabled — Strong DNS Integrity

DNSSEC is enabled for meridiandefence.com.au, providing cryptographic verification of DNS responses. This prevents DNS cache poisoning and ensures clients receive authentic DNS data. DNSSEC is a requirement for DISP members handling Defence information.

Evidence

DNSSEC: Enabled ✓
DS records present in parent zone (.com.au)
Cloudflare manages DNSSEC signing automatically

Note: .com.au is a DNSSEC-signed TLD (auDA requirement since 2021)

Remediation

No action required. DNSSEC is correctly configured and maintained by Cloudflare.

ISM-1706 PSPF INFOSEC-6IS18-SEC-06

MDS-014Info0.0/10 Low

Email Authentication Fully Configured — SPF, DKIM, DMARC at Maximum Enforcement

All three core email authentication protocols are configured at their strictest enforcement levels: SPF with hardfail (-all), DKIM with three active selectors, and DMARC with reject policy at 100% coverage. This represents best-practice email security and meets ISM, PSPF, and E8 requirements.

Evidence

SPF: v=spf1 include:spf.protection.outlook.com include:_spf.sophos.com ip4:203.45.67.0/24 -all
  Qualifier: hardfail (-all) ✓
  Lookup count: 4/10 ✓

DKIM: 3 selectors found (selector1, selector2, sophos) ✓
  selector1: RSA 2048-bit (Microsoft 365)
  selector2: RSA 2048-bit (Microsoft 365)
  sophos: RSA 2048-bit (Sophos Email Gateway)

DMARC: v=DMARC1; p=reject; rua=mailto:...; ruf=mailto:...; fo=1; adkim=s; aspf=s; pct=100
  Policy: reject ✓
  Alignment: strict (adkim=s, aspf=s) ✓
  Reporting: aggregate + forensic ✓
  Coverage: 100% ✓

Remediation

No action required. Email authentication is at maximum enforcement. Continue monitoring DMARC reports for authentication failures.

Netier manages DMARC reporting via the Managed Email Security service, with monthly aggregate analysis and incident response for authentication failures.

ISM-0574 ISM-1151 ISM-0269 ISM-1540 ISM-1799 CIS 9.5 PSPF INFOSEC-3 PSPF INFOSEC-5

MDS-015Info0.0/10 Low

MTA-STS Enforce Mode Active with TLS-RPT Reporting

MTA-STS is configured in enforce mode, requiring sending mail servers to use TLS when delivering to Meridian's mail servers. TLS-RPT is also configured, providing visibility into TLS negotiation failures. This combination ensures encrypted email transport with monitoring.

Evidence

MTA-STS DNS Record: v=STSv1; id=20260215T000000 ✓
MTA-STS Mode: enforce ✓
MTA-STS Policy File: accessible ✓
TLS-RPT: v=TLSRPTv1; rua=mailto:tls-rpt@meridiandefence.com.au ✓

MTA-STS enforces that sending servers must:
  1. Connect via TLS (not plaintext)
  2. Verify the MX certificate matches the policy
  3. Report failures to the TLS-RPT address

Remediation

No action required. MTA-STS and TLS-RPT are correctly configured.

Note: Consider increasing max_age from 604800 (7 days) to 31557600 (1 year) — see finding MDS-008.

ISM-1589 ISM-1590 ISM-1026 PSPF INFOSEC-11

MDS-016Info0.0/10 Low

Comprehensive Security Headers — 8 of 9 Headers Present

The web application implements 8 of 9 recommended security headers, achieving an A grade (89%). All critical headers are present including HSTS with preload directive, CSP with explicit source restrictions, and modern clickjacking protection.

Evidence

Security Headers Present (8/9):
  ✓ Strict-Transport-Security (max-age=31536000; includeSubDomains; preload)
  ✓ Content-Security-Policy (comprehensive policy with 9 directives)
  ✓ X-Frame-Options (DENY)
  ✓ X-Content-Type-Options (nosniff)
  ✓ Referrer-Policy (strict-origin-when-cross-origin)
  ✓ Permissions-Policy (camera, microphone, geolocation, payment restricted)
  ✓ X-XSS-Protection (0 — correct modern setting)
  ✓ Cache-Control (present via Cloudflare)

  ✗ Cross-Origin-Embedder-Policy (not set)

Header Score: 89% (A)

Remediation

Optional enhancement: Add Cross-Origin-Embedder-Policy header for cross-origin isolation:

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin

⚠️ Test thoroughly — COEP can break third-party resources (images, scripts, iframes) that don't set CORS headers. Only enable if the site doesn't embed external resources.

ISM-1485 ISM-1486 ISM-1488 ISM-1489

04 — Risk Assessment

Risk Matrix

Findings plotted by likelihood and impact

Risk Assessment Matrix — Likelihood vs Impact

Negligible

Minor

Moderate

Major

Severe

Almost Certain

Likely

Possible

MDS-002 MDS-004 MDS-013 MDS-014 MDS-015 MDS-016

MDS-001

Unlikely

MDS-010

MDS-003 MDS-005 MDS-006

Rare

05 — Compliance

Compliance & Framework Assessment

Alignment against 10 industry frameworks

ML2

Application Control

CSP with explicit source restrictions, Cloudflare WAF active

ML2

Patch Applications

TLS 1.3, current certificates, no known CVEs in server stack

N/A

Configure Microsoft Office Macros

Internal audit required

ML2

User Application Hardening

All security headers present, CSP blocks mixed content, Perm

N/A

Restrict Administrative Privileges

Internal audit required

ML2

Patch Operating Systems

TLS 1.3 supported, TLS 1.0/1.1 disabled, Cloudflare edge pat

N/A

Multi-factor Authentication

Internal audit required

N/A

Regular Backups

Internal audit required

4 of 8 controls assessed externally 4 require internal audit

Id	Control	Status	Evidence
`ISM-0574`	SPF specification	pass	SPF record with hardfail (-all), 4 lookups
`ISM-1151`	SPF verification	pass	SPF hardfail qualifier
`ISM-0269`	DKIM records	pass	3 DKIM selectors active (selector1, selector2, sophos)
`ISM-1540`	DMARC configuration	pass	DMARC with p=reject, adkim=s, aspf=s
`ISM-1799`	DMARC enforcement	pass	DMARC p=reject at 100% coverage
`ISM-0569`	Email gateway routing	pass	MX points to Exchange Online Protection
`ISM-1589`	MTA-STS enforcement	pass	MTA-STS mode=enforce
`ISM-1590`	TLS-RPT reporting	pass	TLS-RPT configured with rua= address
`ISM-1026`	SMTP STARTTLS	pass	STARTTLS supported on MX
`ISM-1552`	HTTPS enforcement	pass	HTTP→HTTPS redirect, HSTS with preload directive
`ISM-1139`	TLS version compliance	pass	TLS 1.2 and 1.3 only, TLS 1.0/1.1 disabled
`ISM-1369`	Perfect forward secrecy	pass	ECDH-P256 key exchange, TLS 1.3 (inherent PFS)
`ISM-1372`	Strong cipher suites	pass	AES-256 cipher
`ISM-1448`	Certificate validity	pass	Certificate valid, expires 2026-09-15 (193 days)
`ISM-1553`	Certificate authority trust	pass	Issued by Let's Encrypt (trusted CA)
`ISM-1563`	Certificate key strength	pass	ECDH-P256 key exchange
`ISM-1485`	Security headers	pass	HSTS + X-Content-Type-Options + X-Frame-Options + CSP
`ISM-1486`	HSTS configuration	pass	max-age=31536000, includeSubDomains, preload
`ISM-1488`	Content Security Policy	partial	CSP present with 9 directives but contains unsafe-inline
`ISM-1489`	Clickjacking protection	pass	X-Frame-Options: DENY + CSP frame-ancestors 'none'
`ISM-0659`	Content filtering	pass	CAA records + CSP configured
`ISM-1157`	Gateway security	pass	Cloudflare WAF active
`ISM-1490`	Cookie security	pass	Secure + HttpOnly + SameSite=Lax
`ISM-1706`	DNSSEC	pass	DNSSEC enabled, DS records in parent zone
`ISM-1707`	CAA records	pass	CAA restricts to letsencrypt.org and digicert.com
`ISM-1710`	Nameserver diversity	pass	2 nameservers across different subnets (Cloudflare)
`ISM-0580`	Zone transfer protection	pass	Cloudflare manages DNS (AXFR not applicable)
`ISM-1373`	HSTS preload enrolment	partial	Preload directive set but not yet on preload list
`ISM-1554`	TLS downgrade prevention	pass	TLS 1.0/1.1 disabled
`ISM-1374`	Certificate transparency	pass	Certificates logged in CT, 47 entries
`ISM-1579`	Domain reputation	pass	Not listed on any DNSBL or RHSBL (0/9)
`ISM-1580`	Subdomain management	partial	12 subdomains discovered, dev/staging may need access restriction
`ISM-1412`	Server info disclosure	pass	Server: cloudflare (generic, no version)
`ISM-1416`	Directory listing	pass	No directory listing detected
`ISM-0994`	HTTP method restriction	pass	Standard methods only (GET, POST, HEAD)
`ISM-1557`	CORS policy	pass	No wildcard origin, credentials not allowed
`ISM-1558`	Referrer policy	pass	strict-origin-when-cross-origin
`ISM-1559`	Permissions policy	pass	camera, microphone, geolocation, payment restricted

Control	Status	Evidence
INFOSEC-3: Email authentication	pass	SPF ✓, DKIM ✓, DMARC p=reject ✓
INFOSEC-4: Web security	pass	HSTS ✓, CSP ✓, all security headers present
INFOSEC-5: DMARC enforcement	pass	DMARC p=reject at 100% coverage
INFOSEC-6: DNSSEC and CAA	pass	DNSSEC enabled ✓, CAA records configured ✓
INFOSEC-7: TLS standards	pass	TLS 1.3, HSTS preload directive, PFS enabled
INFOSEC-8: Certificate management	pass	Automated renewal via Cloudflare, valid cert
INFOSEC-9: Content security	partial	CSP present but contains unsafe-inline
INFOSEC-10: E8 alignment	pass	ML2 on 4/4 externally assessable controls
INFOSEC-11: Email encryption	partial	MTA-STS enforce ✓, TLS-RPT ✓, but DANE not configured
GOVSEC-3: Information disclosure	pass	No server version, no directory listing, generic server header

Control	Status	Evidence
Encrypt sensitive data in transit	pass	TLS 1.3, HSTS, MTA-STS
DNS filtering	pass	Cloudflare DNS with DNSSEC
DMARC enforcement	pass	DMARC p=reject
Content blocking	pass	CSP with explicit restrictions
DNS infrastructure	pass	DNSSEC, CAA, diverse NS
Encrypt web traffic	pass	TLS 1.3, HSTS preload

Overall CSF Score: 67% (20/30)

Govern

4/5

Identify

4/5

Protect

4/5

Detect

3/5

Respond

3/5

Recover

2/5

Control	Status	Evidence
Secure configurations	pass	Security headers, HSTS, CSP
Strong cryptography	pass	TLS 1.3, AES-256, PFS
Web application attacks	pass	Cloudflare WAF, CSP, X-Frame-Options
Public-facing apps	pass	WAF active, security headers configured
Coding vulnerabilities	partial	CSP contains unsafe-inline

Control	Status	Evidence
Firewalls	pass	Cloudflare WAF active
Secure Configuration	pass	8/9 security headers, HSTS, CSP
Access Control	pass	CORS restricted, Permissions-Policy set
Malware Protection	pass	CSP blocks unauthorized scripts
Patch Management	pass	TLS 1.3, current certificates

Control	Status	Evidence
Broken Access Control	pass	CORS restricted, X-Frame-Options DENY
Cryptographic Failures	pass	TLS 1.3, PFS, HSTS preload
Injection	partial	CSP present but unsafe-inline weakens XSS protection
Security Misconfiguration	pass	8/9 headers, DNSSEC, CAA, no info disclosure
Vulnerable Components	pass	No outdated server software detected
Logging and Monitoring	pass	DMARC reporting, TLS-RPT, Cloudflare analytics

Control	Status	Evidence
Information transfer	pass	TLS 1.3, MTA-STS enforce, STARTTLS
Cloud services	pass	Cloudflare (WAF, CDN, DNS), M365 (email)
Legal requirements	pass	Australian hosting, security.txt present
Compliance	pass	E8 ML2, ISM aligned, PSPF compliant
Endpoint devices (HSTS)	pass	HSTS with 1-year max-age + preload
Malware protection (CSP)	partial	CSP present but contains unsafe-inline
Configuration management	pass	Security headers configured, DNSSEC enabled
Network security	pass	Cloudflare WAF, TLS 1.2+, HSTS
Network services	pass	DNS quality: consistent propagation, diversity
Use of cryptography	pass	TLS 1.3, AES-256, ECDH-P256, PFS
Secure development	pass	CSP, cookie security, CORS configured
Application security	partial	Strong headers but mobile performance issues

Defence Industry Security Program

DISP membership compliance assessment

82%

9 pass · 2 partial · 2 N/A

Governance

Id	Control	Status	Evidence
`DISP-GOV-01`	Security governance	pass	security.txt present, DMARC forensic reporting configured
`DISP-GOV-02`	Defence industry obligations	pass	Australian-hosted (Cloudflare Sydney), .com.au domain with auDA governance

Personnel Security

Id	Control	Status	Evidence
`DISP-PERS-01`	Personnel security	N/A	Requires internal assessment — clearance status not externally verifiable

Physical Security

Id	Control	Status	Evidence
`DISP-PHYS-01`	Physical security	N/A	Requires internal assessment — physical controls not externally verifiable

ICT Security

Id	Control	Status	Evidence
`DISP-ICT-01`	ICT security — encryption	pass	TLS 1.3, AES-256, PFS, MTA-STS enforce
`DISP-ICT-02`	ICT security — email	pass	SPF -all, DKIM 3 selectors, DMARC reject, MTA-STS enforce
`DISP-ICT-03`	ICT security — web	pass	8/9 security headers, CSP, HSTS preload, WAF
`DISP-ICT-04`	ICT security — DNS	pass	DNSSEC enabled, CAA configured, diverse nameservers
`DISP-ICT-05`	ICT security — patching	pass	TLS 1.3, current certificates, no known CVEs
`DISP-ICT-06`	ICT security — access control	partial	CORS restricted, but dev/staging subdomains may need Zero Trust
`DISP-ICT-07`	ICT security — monitoring	pass	DMARC aggregate+forensic, TLS-RPT, CT monitoring, Cloudflare analytics

ISM Alignment

Id	Control	Status	Evidence
`DISP-ISM-01`	ISM alignment	pass	35/38 ISM controls pass, 3 partial (CSP unsafe-inline, HSTS preload, subdomain mgmt)

Essential Eight

Id	Control	Status	Evidence
`DISP-E8-01`	Essential Eight ML2	partial	ML2 on 4/4 externally assessable, 4/4 require internal assessment

06 — Email Authentication

Email Security Deep Dive

SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE, and BIMI analysis

Protocol	Status	Details
SPF	Found	`v=spf1 include:spf.protection.outlook.com include:_spf.sophos.com ip4:203.45.67.0/24 -all` Qualifier: -all
DKIM	Found	Checked 20 selectors Found: selector1, selector2, sophos
DMARC	Found	`v=DMARC1; p=reject; rua=mailto:dmarc-rua@meridiandefence.com.au; ruf=mailto:dmarc-ruf@meridiandefence.com.au; fo=1; adkim=s; aspf=s; pct=100` Policy: reject
MTA-STS	enforce	v=STSv1; id=20260215T000000
TLS-RPT	Configured	v=TLSRPTv1; rua=mailto:tls-rpt@meridiandefence.com.au
DANE/TLSA	Not Found	No TLSA records
BIMI	Not Found	No BIMI record

Advanced Email Protocols

MTA-STS Configured

Mode: enforce

Enforces TLS for inbound email delivery, preventing downgrade attacks.

TLS-RPT Configured

TLS reporting enabled — receives notifications when email TLS negotiation fails.

DANE/TLSA Not Configured

No TLSA records found. DANE provides additional email transport security beyond MTA-STS.

BIMI Not Configured

No BIMI record. Adding a verified brand logo increases email trust and recipient engagement.

SPF Mechanism Analysis

Total Mechanisms

2/10

DNS Lookups

Includes

-all

Qualifier

Hardfail (strict)

include:spf.protection.outlook.cominclude:_spf.sophos.comip4:203.45.67.0/24-all

Email Security: A (92%) — This section meets or exceeds industry best practices.

07 — DNS & Domain

DNS & Domain Infrastructure

Nameservers, records, and DNSSEC status

Record Type	Value
CAA	{"flags":0,"tag":"issue","value":"letsencrypt.org"} {"flags":0,"tag":"issue","value":"digicert.com"} {"flags":0,"tag":"issuewild","value":"letsencrypt.org"} {"flags":0,"tag":"iodef","value":"mailto:security@meridiandefence.com.au"}
DNSSEC	Not Enabled

Infrastructure Geolocation

IP	Location	ISP / Org
104.18.32.47	Sydney, Australia	Cloudflare, Inc.
104.18.33.47	Sydney, Australia	Cloudflare, Inc.

DNS & Infrastructure: A (90%) — This section meets or exceeds industry best practices.

08 — DNS Quality

DNS Quality Metrics

Nameserver diversity, propagation, and configuration health

Nameservers

true

NS Providers

3650d

SOA Serial Age

Wildcard DNS

DNS Propagation Check

Consistent

DNS resolution is consistent across global resolvers.

Resolver	Results
	N/A
	N/A
	N/A

TTL Values

Record Type	TTL (seconds)
A	300
MX	300
NS	86400

09 — Security Headers

HTTP Security Headers

Analysis of security-related HTTP response headers

8/9 security headers present (89%)

Header	Status	Value
Strict-Transport-Security	Present	max-age=31536000; includeSubDomains; preload
Content-Security-Policy	Present	default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.meridiandefence.com.au; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
X-Frame-Options	Present	DENY
X-Content-Type-Options	Present	nosniff
Referrer-Policy	Present	strict-origin-when-cross-origin
Permissions-Policy	Present	camera=(), microphone=(), geolocation=(), payment=()
X-XSS-Protection	Present	0
Cross-Origin-Opener-Policy	Missing	—
Cross-Origin-Resource-Policy	Missing	—
Cross-Origin-Embedder-Policy	Missing	—
Cache-Control	Missing	—
Server	Present	cloudflare

Web Security: A (89%) — This section meets or exceeds industry best practices.

10 — Web Security

Cookie, CORS & Web Security

Cookie flags, CORS policy, mixed content, and CSP analysis

Cookies

Cookie	Secure	HttpOnly	SameSite
`__cf_bm`	Yes	Yes	None
`_cf_clearance`	Yes	Yes	None
`ASP.NET_SessionId`	Yes	Yes	Strict
`__RequestVerificationToken`	Yes	Yes	Strict

CORS Policy

Access-Control-Allow-Origin: Not set

CSP Analysis

Content-Security-Policy

{
  "directives": [
    {
      "name": "default-src",
      "value": "'self'",
      "score": "good"
    },
    {
      "name": "script-src",
      "value": "'self' 'unsafe-inline' https://cdn.meridiandefence.com.au",
      "score": "warning",
      "note": "'unsafe-inline' weakens script-src"
    },
    {
      "name": "style-src",
      "value": "'self' 'unsafe-inline'",
      "score": "warning",
      "note": "'unsafe-inline' weakens style-src"
    },
    {
      "name": "img-src",
      "value": "'self' data: https:",
      "score": "good"
    },
    {
      "name": "font-src",
      "value": "'self' https://fonts.gstatic.com",
      "score": "good"
    },
    {
      "name": "frame-ancestors",
      "value": "'none'",
      "score": "good"
    },
    {
      "name": "base-uri",
      "value": "'self'",
      "score": "good"
    },
    {
      "name": "form-action",
      "value": "'self'",
      "score": "good"
    },
    {
      "name": "upgrade-insecure-requests",
      "value": "",
      "score": "good"
    }
  ],
  "raw": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.meridiandefence.com.au; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests",
  "missingDirectives": [
    {
      "name": "object-src",
      "severity": "medium",
      "recommendation": "Add object-src 'none' to prevent Flash/plugin execution"
    },
    {
      "name": "worker-src",
      "severity": "low",
      "recommendation": "Add worker-src 'self' to control web worker origins"
    },
    {
      "name": "connect-src",
      "severity": "low",
      "recommendation": "Add connect-src to restrict XHR/fetch/WebSocket origins"
    }
  ]
}

11 — Reputation

Blacklist & Email Reputation

DNSBL and domain reputation checks

IP Blacklist Checks

DNSBL	Status
Spamhaus ZEN	Clean
Barracuda	Clean
SpamCop	Clean
Spamhaus ZEN	Clean
Barracuda	Clean
SpamCop	Clean

Domain Blacklist Checks

DNSBL	Status
Spamhaus DBL	Clean
SURBL	Clean
URIBL	Clean
Google Safe Browsing	Clean
PhishTank	Clean
OpenPhish	Clean
URLhaus	Clean

12 — Protection

MITM Attack Surface

Man-in-the-Middle resistance across web and email channels

88/100

LOW RISK

Lower is better. Score based on detected vulnerabilities.

TLS Version Support

Version	Supported	Status
TLSv1	No	OK
TLSv1.1	No	OK
TLSv1.2	Yes	OK
TLSv1.3	Yes	OK

HSTS Preload Status

Check	Result
Preloaded	No
Status	eligible

HTTP → HTTPS Redirect Chain

Mixed Content

No mixed content detected

SMTP STARTTLS

Check	Result
Connected	Yes
STARTTLS	Supported
Required (REQUIRETLS)	Yes

MITM Resilience: A (91%) — This section meets or exceeds industry best practices.

13 — SMTP

SMTP Analysis

Mail server banner, capabilities, and encryption

Check	Result
Banner	220 meridiandefence-com-au.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready
EHLO Capabilities	N/A
STARTTLS	Supported
PTR Record	[object Object]

14 — OSINT

OSINT & Historical Intelligence

Certificate transparency, archived snapshots, and subdomain enumeration

Archive.is

Archived snapshots available: https://archive.is/meridiandefence.com.au ↗

Browse all snapshots ↗

Typosquatting & Similar Domains

Common misspellings and confusable domain variants that could be used for phishing or brand impersonation. These should be monitored or defensively registered.

126 variants generated: 12 tld variant, 8 homoglyph, 14 transposed, 52 adjacent key, 15 missing letter, 15 doubled letter, 10 hyphenation

meridiandefence.com TLD variant WHOIS ↗

mеridiandefence.com.au Homoglyph WHOIS ↗

emridiandefence.com.au Transposed WHOIS ↗

neridiandefence.com.au Adjacent key WHOIS ↗

eridiandefence.com.au Missing letter WHOIS ↗

mmeridiandefence.com.au Doubled letter WHOIS ↗

m-eridiandefence.com.au Hyphenation WHOIS ↗

meridiandefence.net TLD variant WHOIS ↗

merіdiandefence.com.au Homoglyph WHOIS ↗

mreidiandefence.com.au Transposed WHOIS ↗

jeridiandefence.com.au Adjacent key WHOIS ↗

mridiandefence.com.au Missing letter WHOIS ↗

meeridiandefence.com.au Doubled letter WHOIS ↗

me-ridiandefence.com.au Hyphenation WHOIS ↗

meridiandefence.org TLD variant WHOIS ↗

meridіandefence.com.au Homoglyph WHOIS ↗

meirdiandefence.com.au Transposed WHOIS ↗

keridiandefence.com.au Adjacent key WHOIS ↗

meidiandefence.com.au Missing letter WHOIS ↗

merridiandefence.com.au Doubled letter WHOIS ↗

mer-idiandefence.com.au Hyphenation WHOIS ↗

meridiandefence.io TLD variant WHOIS ↗

meridiаndefence.com.au Homoglyph WHOIS ↗

merdiiandefence.com.au Transposed WHOIS ↗

Showing 24 of 126 variants (highest-threat first)

Discovered Subdomains (12)

Subdomain
www
mail
autodiscover
sip
lyncdiscover
enterpriseregistration
enterpriseenrollment
portal
vpn
intranet
dev
staging

OSINT Exposure: B (82%) — This section meets or exceeds industry best practices.

15 — Technology

Technology Stack

Detected platform, CDN, WAF, and server details

145ms

Response Time

Fast

3ms

DNS Lookup

142ms

Server Processing

Component	Details
Platform	Custom
CDN	Cloudflare
WAF	Cloudflare
Server	cloudflare
Framework	ASP.NET
TLS Version	TLS 1.3
Cipher Suite	Aes256
SSL Expiry	2026-09-15
Perfect Forward Secrecy	Yes

16 — Hosting

Hosting & Infrastructure

Hosting provider, server software, CMS detection, and certificate history

Component	Details
Hosting Provider	Cloudflare
ASN Organization	Cloudflare, Inc.

Certificate Issuer History

Issuer	Certificates	First Seen	Last Seen
	undefined
	undefined

17 — WHOIS & Domain Intel

WHOIS & Domain Intelligence

Domain registration, expiry, registrant contacts, and TLD-specific status analysis via RDAP

9y 11m

Domain Age

374d

Until Expiry

Status Codes

9y 11m old — 91% of registration period elapsed

Registered: 2016-03-15TodayExpires: 2027-03-15

Domain Profile

Field	Value
Registrar	Cloudflare Registrar
Registry / WHOIS Server	auDA
TLD	.com.au
Registered	2016-03-15 (9y 11m ago)
Expires	2027-03-15 (374 days remaining)
Registrant Privacy	No (public registration)
RDAP Source	https://rdap.afilias-srs.net/rdap/com.au/

Contact Information

Role	Name	Organisation	Country	Email
Registrant	Meridian Defence Systems Pty Ltd	Meridian Defence Systems Pty Ltd	AU	domains@meridiandefence.com.au
Administrative	IT Operations	Meridian Defence Systems Pty Ltd	AU	it@meridiandefence.com.au
Technical	Netier IT Solutions	Netier Pty Ltd	AU	support@netier.com.au

Domain Status Codes

Status Code	Interpretation	Severity
`serverTransferProhibited`	Registry lock prevents unauthorized transfers	info
`clientTransferProhibited`	Registrar lock prevents unauthorized transfers	info

.com.au — auDA Governed
Governed by the Australian Domain Administration (auDA). Registrants must meet Australian presence requirements. serverRenewProhibited is standard auDA behaviour and does not indicate a problem.

RDAP Nameservers

ada.ns.cloudflare.com
duke.ns.cloudflare.com

18 — SEO & Visibility

SEO & Visibility

Meta tags, Open Graph, structured data, and sitemap analysis

Check	Status	Details
Title Tag	Found	Meridian Defence Systems \| Sovereign Defence Engineering Solutions (62 chars - over recommended 60)
Meta Description	Found	Australia's leading sovereign defence engineering company. DISP-approved contractor delivering advan... (196 chars - over recommended 160)
Canonical URL	Found	https://meridiandefence.com.au/
Viewport Meta	Found	Present
JSON-LD Structured Data	Found	Present
Twitter Card	Found	[object Object]
Sitemap	Found	Accessible (120 URLs)

Open Graph Tags

Property	Value
`og:title`	Meridian Defence Systems \| Sovereign Defence Engineering
`og:description`	Australia's leading sovereign defence engineering company. DISP-approved contractor delivering advanced systems integration and cybersecurity solutions.
`og:image`	https://meridiandefence.com.au/images/og-banner.jpg
`og:url`	https://meridiandefence.com.au
`og:type`	website
`og:site_name`	Meridian Defence Systems

Social Share Previews

How this site appears when shared on social platforms.

iMessage / Link Preview

Meridian Defence Systems | Sovereign Defence Engineering

meridiandefence.com.au

Twitter / X

Meridian Defence Systems | Sovereign Defence Engineering

Australia's leading sovereign defence engineering company. DISP-approved contractor delivering advanced systems integration and cybersecurity solutions.

meridiandefence.com.au

Facebook

meridiandefence.com.au

Meridian Defence Systems | Sovereign Defence Engineering

Australia's leading sovereign defence engineering company. DISP-approved contractor delivering advanced systems integration and cybersecurity solutions.

robots.txt Directives (2)

Parsed Directives

index
follow

19 — PageSpeed & Performance

PageSpeed & Performance

Google Lighthouse performance analysis via PageSpeed Insights API

Mobile

Performance

Needs Work

Accessibility

Needs Work

Best Practices

Poor

SEO

Good

Improvement Opportunities

Opportunity	Potential Savings
Reduce unused JavaScript	0.8 s
Properly size images	0.5 s
Eliminate render-blocking resources	0.4 s
Serve images in next-gen formats	0.3 s

Desktop

Performance

Needs Work

Accessibility

Good

Best Practices

Poor

SEO

Good

Improvement Opportunities

Opportunity	Potential Savings
Properly size images	0.3 s
Serve images in next-gen formats	0.2 s

Data from Google PageSpeed Insights API (Lighthouse). Scores are 0–100. ● Good (90+) ● Needs Work (50–89) ● Poor (<50)

20 — Site Structure

Site Structure & Crawl Analysis

Pages discovered via HTTP crawl compared against sitemap.xml

Pages Crawled

120

Sitemap URLs

Sitemap Coverage

Broken Links

In Both (Crawl + Sitemap)

Crawl Only (not in sitemap)

Sitemap Only (not crawled)

Broken (4xx/5xx/timeout)

Site Map Diagram

graph TD
    A["/ — Home"] --> B["about/"]
    A --> C["capabilities/"]
    A --> D["projects/"]
    A --> E["innovation/"]
    A --> F["careers/"]
    A --> G["news/"]
    A --> H["contact/"]
    A --> I["security-policy/"]
    A --> J["privacy-policy/"]
    A --> K["terms/"]
    B --> B1["leadership/"]
    B --> B2["history/"]
    B --> B3["locations/"]
    B --> B4["partnerships/"]
    C --> C1["systems-integration/"]
    C --> C2["cybersecurity/"]
    C --> C3["platform-sustainment/"]
    C --> C4["electronic-warfare/"]
    C --> C5["simulation-training/"]
    C --> C6["autonomous-systems/"]
    C --> C7["c4isr/"]
    C --> C8["maritime-systems/"]
    C --> C9["land-systems/"]
    C --> C10["aerospace/"]
    D --> D1["jp-9101/"]
    D --> D2["land-400/"]
    D --> D3["sea-5000/"]
    D --> D4["air-6500/"]
    D --> D5["dsp-1234/"]:::broken
    D --> D6["overlander/"]
    E --> E1["research/"]
    E --> E2["patents/"]
    E --> E3["partnerships/"]:::redirect
    F --> F1["open-positions/"]
    F --> F2["graduate-program/"]
    F --> F3["culture/"]
    F --> F4["benefits/"]
    G --> G1["contract-award-jp9101/"]
    G --> G2["disp-recertification/"]
    G --> G3["avalon-airshow/"]
    G --> G4["graduate-intake/"]
    H --> H1["canberra/"]
    H --> H2["adelaide/"]
    B2 --> X1["old-brochure.pdf"]:::broken
    G --> X2["press-kit-2024/"]:::broken
    classDef broken fill:#ef5350,stroke:#c62828,color:#fff
    classDef redirect fill:#ffa400,stroke:#e65100,color:#fff

Mermaid diagram (enable JavaScript or view in a Mermaid-compatible renderer) graph TD A["/ — Home"] --> B["about/"] A --> C["capabilities/"] A --> D["projects/"] A --> E["innovation/"] A --> F["careers/"] A --> G["news/"] A --> H["contact/"] A --> I["security-policy/"] A --> J["privacy-policy/"] A --> K["terms/"] B --> B1["leadership/"] B --> B2["history/"] B --> B3["locations/"] B --> B4["partnerships/"] C --> C1["systems-integration/"] C --> C2["cybersecurity/"] C --> C3["platform-sustainment/"] C --> C4["electronic-warfare/"] C --> C5["simulation-training/"] C --> C6["autonomous-systems/"] C --> C7["c4isr/"] C --> C8["maritime-systems/"] C --> C9["land-systems/"] C --> C10["aerospace/"] D --> D1["jp-9101/"] D --> D2["land-400/"] D --> D3["sea-5000/"] D --> D4["air-6500/"] D --> D5["dsp-1234/"]:::broken D --> D6["overlander/"] E --> E1["research/"] E --> E2["patents/"] E --> E3["partnerships/"]:::redirect F --> F1["open-positions/"] F --> F2["graduate-program/"] F --> F3["culture/"] F --> F4["benefits/"] G --> G1["contract-award-jp9101/"] G --> G2["disp-recertification/"] G --> G3["avalon-airshow/"] G --> G4["graduate-intake/"] H --> H1["canberra/"] H --> H2["adelaide/"] B2 --> X1["old-brochure.pdf"]:::broken G --> X2["press-kit-2024/"]:::broken classDef broken fill:#ef5350,stroke:#c62828,color:#fff classDef redirect fill:#ffa400,stroke:#e65100,color:#fff

Broken Links (3)

URL	Status	Linked From
`https://meridiandefence.com.au/projects/dsp-1234/`	404	—
`https://meridiandefence.com.au/old-brochure.pdf`	404	—
`https://meridiandefence.com.au/media/press-kit-2024/`	404	—

Crawled 45 pages in 0.0s • Max depth: 2 • Max pages: 30 • Sitemap: https://meridiandefence.com.au/sitemap.xml

21 — Monitoring

Proactive Monitoring Recommendations

Recommended monitoring and alerting setup

Monitor	Tool	Frequency
DMARC aggregate report analysis	Valimail / dmarcian	Weekly
Certificate Transparency monitoring	crt.sh / Cloudflare CT alerts	Real-time
DNSBL/RHSBL monitoring	HetrixTools	Every 6 hours
SSL certificate expiry	Uptime Kuma / Netier RMM	Daily
Security header changes	Netier domain-monitor	Every 6 hours
PageSpeed performance regression	Lighthouse CI / Cloudflare Observatory	Weekly

22 — Roadmap

Recommendations & Remediation Roadmap

Prioritized actions grouped by timeline

Immediate (0-48 hours)

Finding	Severity	Action	Effort
`MDS-005`	Medium	Add missing CSP directives via Cloudflare Transform Rule	15 min
`MDS-008`	Low	Increase MTA-STS max_age to 31557600	5 min
`MDS-009`	Low	Generate PGP key and add Encryption field to security.txt	30 min

Short Term (1-2 weeks)

Finding	Severity	Action	Effort
`MDS-003`	Medium	Configure BIMI DNS record and host SVG logo	30 min
`MDS-006`	Medium	Audit all subdomains for HTTPS support, then submit to HSTS preload list	2 hours
`MDS-004`	Medium	Replace CSP unsafe-inline with nonce-based script loading	4-8 hours
`MDS-007`	Medium	Place dev/staging behind Cloudflare Access Zero Trust	2 hours

Medium Term (1-3 months)

Finding	Severity	Action	Effort
`MDS-001`	High	Evaluate DANE/TLSA via dedicated MTA gateway for email transport security	2-3 days
`MDS-002`	High	Mobile performance optimisation via Cloudflare features and code changes	1-2 days
`MDS-003`	Medium	Obtain VMC (Verified Mark Certificate) for full BIMI compliance in Gmail/Apple Mail	2-4 weeks (trademark required)

23 — Appendices

Appendices

Raw data, glossary, and disclaimers

A. robots.txt

robots.txt

User-agent: *
Allow: /
Disallow: /admin/
Disallow: /portal/
Disallow: /api/
Disallow: /intranet/
Disallow: /staging/
Sitemap: https://meridiandefence.com.au/sitemap.xml

B. Glossary

Term	Definition
SPF	Sender Policy Framework — restricts which servers can send email for a domain
DKIM	DomainKeys Identified Mail — cryptographic email authentication
DMARC	Domain-based Message Authentication, Reporting & Conformance
MTA-STS	Mail Transfer Agent Strict Transport Security — enforces TLS for email
TLS-RPT	TLS Reporting — receive reports about email TLS failures
DANE/TLSA	DNS-based Authentication of Named Entities — binds certificates to DNS
DNSSEC	Domain Name System Security Extensions — cryptographic DNS validation
CAA	Certificate Authority Authorization — restricts which CAs can issue certificates
BIMI	Brand Indicators for Message Identification — brand logo in email clients
HSTS	HTTP Strict Transport Security — forces HTTPS connections
CSP	Content Security Policy — controls which resources a page can load
DNSBL	DNS-based Blackhole List — real-time email/IP reputation service

C. Disclaimer

This security assessment was performed using publicly available information only. No intrusive testing, penetration testing, or vulnerability exploitation was conducted.

Severity ratings use a qualitative likelihood x impact risk matrix aligned with ISO 27005. Risk scores are indicative and based on professional judgement.

This document is classified CONFIDENTIAL and is intended solely for the named recipient.

Assessment methodology references: NIST SP 800-177 Rev. 1, OWASP Secure Headers Project, PCI DSS v4.0, UK Cyber Essentials, ACSC Essential Eight, ISO 27005.

Domain & EmailSecurity Assessment

Table of Contents

Executive Summary

Assessment Scope

In Scope

Out of Scope

Detailed Findings

DANE/TLSA Records Not Configured for Email Transport

Mobile PageSpeed Performance Below Threshold

BIMI Record Not Configured

CSP Contains 'unsafe-inline' for Scripts

Missing CSP Directives: object-src, media-src, worker-src

HSTS max-age Meets Minimum but Preload Not Yet Active

Subdomain Exposure — 12 Subdomains Discovered

MTA-STS Policy max_age Below Recommended Value

security.txt Missing Encryption Key Field

Cookie SameSite Attribute Set to 'Lax' Instead of 'Strict'

X-XSS-Protection Header Set to '0'

Certificate Transparency Shows Multiple Issuers

DNSSEC Enabled — Strong DNS Integrity

Email Authentication Fully Configured — SPF, DKIM, DMARC at Maximum Enforcement

MTA-STS Enforce Mode Active with TLS-RPT Reporting

Comprehensive Security Headers — 8 of 9 Headers Present

Risk Matrix

Compliance & Framework Assessment

Governance

Personnel Security

Physical Security

ICT Security

ISM Alignment

Essential Eight

Email Security Deep Dive

Advanced Email Protocols

SPF Mechanism Analysis

DNS & Domain Infrastructure

Infrastructure Geolocation

DNS Quality Metrics

DNS Propagation Check

TTL Values

HTTP Security Headers

Cookie, CORS & Web Security

Cookies

CORS Policy

CSP Analysis

Blacklist & Email Reputation

IP Blacklist Checks

Domain Blacklist Checks

MITM Attack Surface

TLS Version Support

HSTS Preload Status

HTTP → HTTPS Redirect Chain

Mixed Content

SMTP STARTTLS

SMTP Analysis

OSINT & Historical Intelligence

Archive.is

Typosquatting & Similar Domains

Discovered Subdomains (12)

Technology Stack

Hosting & Infrastructure

Certificate Issuer History

WHOIS & Domain Intelligence

Domain Profile

Contact Information

Domain Status Codes

RDAP Nameservers

SEO & Visibility

Open Graph Tags

Social Share Previews

robots.txt Directives (2)

PageSpeed & Performance

Mobile

Improvement Opportunities

Desktop

Improvement Opportunities

Site Structure & Crawl Analysis

Site Map Diagram

Broken Links (3)

Proactive Monitoring Recommendations

Recommendations & Remediation Roadmap

Domain & Email
Security Assessment