generated: '2026-08-01'
method: probed
source: live DNS and TLS probe of every Datarails host in apis.yml
description: >-
  Transport and DNS security posture, probed directly. The application and API
  hosts are consistently strong (TLS 1.3, HSTS at 180 days); the marketing host
  ships no HSTS header at all, and the registrable domain has neither DNSSEC
  nor a CAA record. Email authentication is the strongest part of the posture —
  SPF with a hard fail and DMARC at p=reject.

hosts:
  - host: mcp.datarails.com
    role: FinanceOS MCP server
    https: true
    tls_version: TLSv1.3
    cert_issuer: Google Trust Services (WE1)
    cert_not_after: '2026-10-14'
    hsts: true
    hsts_max_age: 15552000
    hsts_includesubdomains: false
    hsts_preload: false
    security_headers:
      x-content-type-options: nosniff
      referrer-policy: strict-origin-when-cross-origin
      x-permitted-cross-domain-policies: none
      permissions-policy: present (geolocation, microphone, camera, gyroscope, magnetometer, payment, usb, midi, push all disabled)
    cdn: Cloudflare
  - host: app.datarails.com
    role: Datarails application and Data Gateway Service REST endpoint
    https: true
    tls_version: TLSv1.3
    cert_issuer: Google Trust Services (WE1)
    cert_not_after: '2026-10-14'
    hsts: true
    hsts_max_age: 15552000
    note: Redirects to https://auth.datarails.com/ when unauthenticated.
  - host: auth.datarails.com
    role: Authentication / SSO entry point
    https: true
    tls_version: TLSv1.3
    cert_issuer: Google Trust Services (WE1)
    cert_not_after: '2026-10-14'
    hsts: true
    hsts_max_age: 15552000
  - host: www.datarails.com
    role: Marketing site and llms.txt
    https: true
    tls_version: TLSv1.3
    cert_issuer: Let's Encrypt (YE2)
    cert_not_after: '2026-09-26'
    hsts: false
    hsts_max_age: null
    note: >-
      No Strict-Transport-Security header on the marketing host. Also returns
      HTTP 403 to non-browser user agents (bot protection), which is why the
      site pages were read through a browser-class fetch.
  - host: trust.datarails.com
    role: Trust center (Vendict-hosted)
    https: true
    note: Third-party hosted; not probed for TLS parameters.
  - host: support.datarails.com
    role: Help center (Zendesk-hosted)
    https: true
    note: Third-party hosted; returns 403 to non-browser user agents.

domains:
  - domain: datarails.com
    dnssec: false
    dnssec_evidence: no DNSKEY records returned
    caa: []
    caa_evidence: no CAA records returned — any public CA may issue for this domain
    spf: true
    spf_record: 'v=spf1 include:mail.zendesk.com mx include:_spf.google.com include:6909491.spf10.hubspotemail.net include:amazonses.com -all'
    spf_policy: hard fail (-all)
    dmarc: true
    dmarc_policy: reject
    dmarc_record: 'v=DMARC1; p=reject; rua=mailto:dmarc@datarails.com, mailto:rpy61q5g9y@rua.powerdmarc.com'
    dmarc_aggregate_reporting: true

third_party_domain_verifications:
  note: >-
    TXT records on datarails.com show which platforms Datarails has verified
    domain ownership with. Recorded because it corroborates the AI-connector
    surface.
  records:
    - google-site-verification
    - openai-domain-verification
    - lovable_verification
    - mongodb-site-verification
    - 'MS= (Microsoft)'

findings:
  - severity: medium
    finding: No CAA record on datarails.com — certificate issuance is not restricted to named CAs.
  - severity: medium
    finding: No DNSSEC on datarails.com.
  - severity: low
    finding: No HSTS on www.datarails.com; the application, auth and API hosts all carry it at 180 days.
  - severity: info
    finding: No HSTS preload and no includeSubDomains on any host.
  - severity: positive
    finding: DMARC at p=reject with aggregate reporting, and SPF with a hard fail.
  - severity: positive
    finding: TLS 1.3 on every first-party host, with a full modern security-header set on the MCP host.

x-evidence:
  fetched: '2026-08-01'
  tools: [dig, 'openssl s_client', 'curl -D']