Transport and DNS security posture across the Energy Queensland estate. Two things stand out. First, the CDR host is the best-configured surface the group operates - HSTS with a two-year max-age and includeSubDomains, nosniff, and DENY framing - which is unsurprising given it was built to a mandated security profile rather than by choice. Second, every domain in the group shares one mail security configuration (SPF pointing at spf.energyq.com.au and Mimecast, DMARC p=reject with the same reporting mailbox), a clear signature of the 2016 Ergon/Energex merger into a single ICT function. No Energy Queensland domain has DNSSEC, and none publishes CAA records.
Domain security posture for Energy Queensland, probed live across 5 host(s) and 5 registrable domain(s). 5 host(s) serve HTTPS (up to TLSv1.3); 1 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=reject).
EnergyAustraliaUtilitiesElectricityGridDistribution NetworkEnergy RetailConsumer Data RightCDRProduct Reference DataQueenslandSmart MeteringSolarDEROpen Data
generated: '2026-07-27'
method: probed
source: >-
Live DNS/TLS/HTTP probes of the apis.yml and OpenAPI hosts via
0-working/probe-domain-security.py, extended with the three registrable
domains the automated pass did not reach (ergonretail.com.au, ergon.com.au,
energex.com.au) and with HSTS observed on a real 200 response rather than on a
HEAD to a 404 path.
description: >-
Transport and DNS security posture across the Energy Queensland estate. Two
things stand out. First, the CDR host is the best-configured surface the group
operates - HSTS with a two-year max-age and includeSubDomains, nosniff, and
DENY framing - which is unsurprising given it was built to a mandated security
profile rather than by choice. Second, every domain in the group shares one
mail security configuration (SPF pointing at spf.energyq.com.au and Mimecast,
DMARC p=reject with the same reporting mailbox), a clear signature of the 2016
Ergon/Energex merger into a single ICT function. No Energy Queensland domain
has DNSSEC, and none publishes CAA records.
hosts:
- host: www.energyq.com.au
role: Energy Queensland group website
https: true
tls_version: TLSv1.3
cert_expires: Sep 24 01:59:30 2026 GMT
hsts: null
note: >-
Behind a Cloudflare managed challenge - returns HTTP 403 to every
programmatic client, so response headers cannot be observed.
- host: cdr.energymadeeasy.gov.au
role: AER Energy Made Easy CDR host serving Ergon-branded Product Reference Data (not an Energy Queensland host)
https: true
tls_version: TLSv1.3
cert_expires: Jan 31 23:59:59 2027 GMT
hsts: false
observed_headers:
access-control-allow-origin: '*'
access-control-expose-headers: x-v, Retry-After, x-fapi-interaction-id
note: AWS API Gateway behind CloudFront. No HSTS header on a live 200 response.
- host: public.cdr.ergonretail.com.au
role: Ergon Energy Retail registered CDR public base URI
https: true
tls_version: TLSv1.3
cert_expires: Oct 18 23:59:59 2026 GMT
hsts: true
hsts_max_age: 63072000
hsts_include_subdomains: true
observed_headers:
strict-transport-security: max-age=63072000; includeSubDomains;
x-content-type-options: nosniff
x-frame-options: DENY
access-control-allow-origin: '*'
access-control-allow-headers: Range, x-v, x-min-v
access-control-max-age: '3600'
note: >-
Observed on a live HTTP 200 from /cds-au/v1/discovery/status on
2026-07-27. The automated probe recorded hsts null because the site root
404s; the header is present on real endpoints.
- host: api.cdr.ergonretail.com.au
role: Ergon Energy Retail CDR consumer-data resource host
https: true
mtls_required: true
note: >-
The TLS handshake emits "Request CERT (13)" with a private CDR certificate
chain - the server demands a client certificate issued by the CDR Register
certificate authority. No HTTP response is obtainable without one, so no
response headers are recorded.
- host: auth.cdr.ergonretail.com.au
role: resolves in DNS; purpose unconfirmed
https: true
note: >-
Serves HTTP but returns 404 at the root, at
/.well-known/oauth-authorization-server and at /cds-au/v1/discovery/status.
Recorded for what it returned; NOT assumed to be the InfoSec base URI.
domains:
- domain: energyq.com.au
dnssec: false
caa: []
spf: true
dmarc: true
dmarc_policy: reject
- domain: ergonretail.com.au
dnssec: false
caa: []
spf: true
spf_record: v=spf1 include:spf.energyq.com.au include:au._netblocks.mimecast.com -all
dmarc: true
dmarc_policy: reject
note: The registrable domain behind both public.cdr and api.cdr - i.e. the entire CDR estate.
- domain: ergon.com.au
dnssec: false
caa: []
spf: true
dmarc: true
dmarc_policy: reject
- domain: energex.com.au
dnssec: false
caa: []
spf: true
spf_record: v=spf1 include:spf.energyq.com.au include:au._netblocks.mimecast.com include:amazonses.com -all
dmarc: true
dmarc_policy: reject
- domain: energymadeeasy.gov.au
dnssec: false
caa:
- 0 issuewild "amazontrust.com"
- 0 issuewild "awstrust.com"
- 0 issuewild "amazon.com"
- 0 issuewild "amazonaws.com"
spf: true
dmarc: true
dmarc_policy: quarantine
note: Australian Energy Regulator domain, not Energy Queensland's. The only domain in scope with CAA records.
findings:
- All four Energy Queensland domains publish SPF and a DMARC policy of p=reject with a shared reporting mailbox - a strong, consistent mail posture.
- No domain in the group has DNSSEC enabled.
- No Energy Queensland domain publishes CAA records, so certificate issuance is unconstrained.
- HSTS is present only on the CDR public base URI, the one host built to a mandated security profile.
- The corporate sites are unobservable from outside a browser (Cloudflare 403), which also means no security.txt or disclosure policy page could be verified. See well-known/energy-queensland-well-known.yml.