generated: '2026-08-25'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: league.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 23 06:41:09 2026 GMT
  hsts: null
  hsts_note: 'NOT observed. A 200 GET of https://league.com/robots.txt returned no Strict-Transport-Security
    header (server: cloudflare). The marketing origin does not set HSTS even though the API and app hosts
    do.'
- host: api.league.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 11 08:06:38 2026 GMT
  hsts: max-age=31536000; includeSubDomains; preload
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: true
  hsts_note: Observed directly on a live GET https://api.league.com/ (2026-08-25). The automated probe
    recorded null because the host answers 404 on /; the header is present regardless of status.
- host: app.league.com
  https: true
  hsts: max-age=31536000; includeSubDomains
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: false
  hsts_note: Observed on a live 200 GET (2026-08-25). Added by hand — not in apis.yml hosts at probe time.
domains:
- domain: league.com
  dnssec: false
  caa:
  - 0 issuewild "ssl.com"
  - 0 issue "amazon.com"
  - 0 issue "comodoca.com"
  - 0 issue "digicert.com; cansignhttpexchanges=yes"
  - 0 issue "geotrust.com"
  - 0 issue "letsencrypt.org"
  spf: true
  dmarc: true
  dmarc_policy: reject
note: HSTS values corrected/added from direct header observation on 2026-08-25. DNSSEC is NOT enabled
  on league.com; CAA, SPF and DMARC are all present, with DMARC at p=reject — a strong email posture.
  The gap worth naming is DNSSEC, and HSTS missing on the marketing origin while present on api. and app.