Is uq.edu.au safe to use as a vendor?

uq.edu.au scored 72/100 on LynxRadar's security posture assessment. The domain partially meets security requirements with some gaps to address. 8 checks passed, 5 warnings, 2 critical issues across 15 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does uq.edu.au use?

uq.edu.au uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does uq.edu.au have DMARC configured?

Yes. uq.edu.au's DMARC policy is set to 'quarantine'. SPF record: yes. Strengths: DMARC policy set to quarantine; SPF record present with soft-fail (~all); DKIM configured (selectors: selector1, selector2, s1, cm).

Does uq.edu.au have SPF configured?

Yes. SPF record: v=spf1 include:_spf.uq.edu.au ~all

Does uq.edu.au have security headers configured?

uq.edu.au has 0 of 5 recommended security headers. Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

Has uq.edu.au been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does uq.edu.au have known CVE vulnerabilities?

Detected technologies: nginx, Drupal 10/(https://www.drupal.org). No high or critical CVEs found for detected versions.

uq.edu.au Security Report — Grade C- (72/100)

Q: Does uq.edu.au use HSTS?

No. Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Q: Is uq.edu.au's SSL certificate valid?

Issues detected. Strengths: Certificate valid, 273 days remaining; Issued by DigiCert Inc; 3750 certificates logged in CT. Issues: Certificates issued by 22 different CAs (threshold: 8 for 3750 logged certs) — possible misconfiguration or shadow IT.

Q: Does uq.edu.au have DNSSEC enabled?

No. Strengths: 4 nameservers configured (ns3.dc.uq.edu.au., ns4.dc.uq.edu.au., ns1.dc.uq.edu.au., ns2.dc.uq.edu.au.); 2 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

C-

Conditional · 72/100

Shows significant security gaps that need urgent attention. Positive signals: DNS CAA Records, TLS Configuration, and Known Breaches all passed. 7 action items identified, including 0 critical. The issues point to real architectural gaps, not just configuration tweaks. A focused remediation effort of 1–2 days could address all findings.

Trust Score Trend

→ No change 1 scan · Last scanned February 24, 2026

Your rating Industry average

Score

100 75 50 25 0

C-

uq.edu.au

72/100

Compliance & Certifications

Not yet verified

FERPA

Not on file

Self-reported

Pro subscribers only

GDPR

DPA not on file

Self-reported

Pro subscribers only

Incident History

None in 12 months

March 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

April 2023 – Feb 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

Security Posture

7 items need attention

8 passed

Turn on HSTS (forces browsers to always use HTTPS)

HSTS Header

< 1 hour

This puts visitor logins and session data at risk of interception on untrusted networks. uq.edu.au doesn't send the HSTS header, so a browser can still be tricked into connecting over plain, unencrypted HTTP instead of HTTPS — an attacker on the same network (e.g. public wifi) can exploit that gap to intercept traffic. Turning HSTS on tells every browser "always use HTTPS for this site, no exceptions."

PCI-DSS 4.0Req 6.4.1

Required application security controls

NIST 800-53SC-8

Transmission confidentiality and integrity

How to fix this

1Add this response header to your site. You're using Fastly in front of this site — add it there, see https://www.fastly.com/documentation/solutions/examples/add-remove-or-change-http-headers/.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2Before adding it, make sure every subdomain (not just the main site) also works over HTTPS — HSTS applies site-wide.

3Confirm it's live: search "http header checker" and enter uq.edu.au.

4Once confirmed, submit the domain at hstspreload.org so browsers enforce HTTPS even on a user's very first visit.

HSTS guide

Report unlocked.

View all 8 passed checks

DNS CAA Records

TLS Configuration

Known Breaches

CVE Exposure

DMARC / Email Security

MX Records & Mail Provider

TLS Protocol Support

Subprocessors & Tech Stack

Company Signals

Claim profile →

Operational risk

Low

11 yrs operating. Well-funded

Lynxradar · Composite signal

Last funding

$40B

Series F · Mar 2025 · SoftBank-led

Crunchbase ↗

Employees

~3,000

+40% YoY growth

LinkedIn ↗

Trust Resources

Claim profile →

Trust Center

trust.uq.edu.au ↗

Security page

uq.edu.au/security ↗

uq.edu.au/privacy ↗

DPA (Data Processing Agreement)

uq.edu.au/dpa ↗

Updated recently

Subprocessors List

uq.edu.au/policies/subprocessors ↗

Tech Stack Detected

Subprocessors

Fastly

Similar companies in Education / EdTech

Appears in

Claim profile →

SOC 2 Type II certified vendors

847 companies · Updated weekly by LynxRadar

Track

ISO 27001 certified SaaS

312 companies · Updated weekly by LynxRadar

Track

Top AI vendors by trust score

94 companies · LynxRadar ranking

Track

Enterprise-ready SaaS · Trust score A or above

203 companies · LynxRadar ranking

Track

Blocking Issues

Not enabled

Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Likelihood: ★★★☆☆

Impact: ★★★★☆

0/5 present

Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

Likelihood: ★★★☆☆

Impact: ★★★☆☆

Medium Priority

Warn

Issues: No MTA-STS configured — email in transit is vulnerable to TLS downgrade attacks. Sending servers cannot verify that your mail server requires TLS; No TLSRPT record — TLS delivery failures won't be reported to domain owner.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Not enabled

Strengths: 4 nameservers configured (ns3.dc.uq.edu.au., ns4.dc.uq.edu.au., ns1.dc.uq.edu.au., ns2.dc.uq.edu.au.); 2 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Warn

Strengths: 1 cookie(s) analyzed; All cookies have Secure flag; All cookies have HttpOnly flag. Issues: 1/1 cookie(s) missing SameSite attribute (uqlb).

Likelihood: ★★★☆☆

Impact: ★★★☆☆

Best Practice

Warn

No security.txt found. Publishing a security.txt at /.well-known/security.txt is the industry standard (RFC 9116) for vulnerability disclosure policies. Its absence may indicate a less mature security program.

Likelihood: ★☆☆☆☆

Impact: ★☆☆☆☆

Issues

Strengths: Certificate valid, 273 days remaining; Issued by DigiCert Inc; 3750 certificates logged in CT. Issues: Certificates issued by 22 different CAs (threshold: 8 for 3750 logged certs) — possible misconfiguration or shadow IT.

Likelihood: ★★☆☆☆

Impact: ★★☆☆☆