Rex Airlines · Domain Security

Rex Airlines Domain Security

Domain security

Domain security posture for Rex Airlines, probed live across 5 host(s) and 2 registrable domain(s). 5 host(s) serve HTTPS (up to TLSv1.3); 3 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=none).

TravelAustraliaAviationAirlineRegional AviationDistributionBookingCorporate TravelLoyaltyFreight

Transport & Host Security

www.rex.com.au

HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Feb 28 03:38:34 2027 GMT

ibe2.rex.com.au

HTTPS: yes · TLS: TLSv1.3 · HSTS: yes

mbe.rex.com.au

HTTPS: yes · TLS: TLSv1.3 · HSTS: yes

flights.rex.com.au

HTTPS: yes · TLS: TLSv1.3 · HSTS: yes

www.rexflyer.com.au

HTTPS: yes · TLS: TLSv1.2 · HSTS: no

Domain (DNS/Email) Security

rex.com.au

DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none

rexflyer.com.au

DNSSEC: no · SPF: no · DMARC: no · CAA: none

Source

Domain Security

generated: '2026-07-28'
method: probed
source: live DNS/TLS/HTTP probes of every host published in apis.yml
note: >-
  Rex publishes no OpenAPI and no API host, so the hosts probed here are the
  public web properties named in apis.yml — the marketing site, the internet
  booking engine, manage-my-booking, the EveryMundo/AirTRFX fare-page host and
  the Rex Flyer loyalty site. Absence of a record (no CAA, no HSTS, no DNSSEC)
  is recorded as measured, not inferred.
hosts:
- host: www.rex.com.au
  https: true
  tls_version: TLSv1.3
  cert_expires: Feb 28 03:38:34 2027 GMT
  hsts: false
- host: ibe2.rex.com.au
  https: true
  tls_version: TLSv1.3
  hsts: true
  hsts_max_age: 2592000
  note: Internet booking engine. Root returned HTTP 500 to a HEAD request at probe time.
- host: mbe.rex.com.au
  https: true
  tls_version: TLSv1.3
  hsts: true
  hsts_max_age: 2592000
  note: Manage My Booking. HTTP 200.
- host: flights.rex.com.au
  https: true
  tls_version: TLSv1.3
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: true
  note: >-
    EveryMundo / AirTRFX fare-marketing pages. HTTP/2, returned 405 to a HEAD
    request. Strongest transport posture of any Rex host — and it is a vendor's
    stack, not Rex's own.
- host: www.rexflyer.com.au
  https: true
  tls_version: TLSv1.2
  hsts: false
  note: Rex Flyer loyalty. Only host still negotiating TLS 1.2 rather than 1.3.
domains:
- domain: rex.com.au
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
- domain: rexflyer.com.au
  dnssec: false
  caa: []
  spf: false
  dmarc: false
  note: >-
    No TXT records at all at the apex — so no SPF — and no _dmarc record. The
    loyalty domain publishes no email authentication of any kind.
findings:
- HSTS is absent on the primary www host and on the loyalty host.
- No CAA records on either registrable domain.
- No DNSSEC on either registrable domain.
- rex.com.au publishes DMARC but at p=none (monitor only, no enforcement).
- rexflyer.com.au publishes neither SPF nor DMARC.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/rex-airlines-domain-security"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.