The addresses were using the Private servers rather than Protected, as per https://www.cira.ca/cybersecurity-services/canadian-shield/configure