generated: '2026-08-23'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: layerx.co.jp
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 24 23:59:59 2026 GMT
  hsts: false
- host: bakuraku.jp
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 11 23:59:59 2026 GMT
  hsts: false
- host: api.bakuraku.layerx.jp
  https: true
  tls_version: TLSv1.2
  cert_expires: Jan 10 23:59:59 2027 GMT
  hsts: true
  hsts_header: 'max-age=15552000; includeSubDomains'
  hsts_note: >-
    The probe read the host root, which the ALB answers with a bare empty 404 carrying no
    headers. A manual anonymous GET of https://api.bakuraku.layerx.jp/rest/v1/tenant/users
    on 2026-08-23 returned strict-transport-security: max-age=15552000; includeSubDomains
    alongside x-content-type-options: nosniff, x-frame-options: SAMEORIGIN and
    x-permitted-cross-domain-policies: none. HSTS is present on the API path, absent from
    the ALB's catch-all 404.
domains:
- domain: layerx.co.jp
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
- domain: bakuraku.jp
  dnssec: false
  caa: []
  spf: false
  dmarc: true
  dmarc_policy: none
notes:
- >-
    Neither layerx.co.jp nor bakuraku.jp publishes a CAA record or signs its zone with
    DNSSEC. bakuraku.jp has no SPF record; layerx.co.jp does. Both DMARC policies are
    p=none, i.e. monitoring only — nothing is quarantined or rejected on a failure.
- >-
    api.bakuraku.layerx.jp negotiates TLS 1.2 while the two web hosts negotiate TLS 1.3;
    Bakuraku's own security page claims TLS 1.3 for communications, which holds for the
    product hosts but not for the API host as probed on 2026-08-23.