generated: '2026-07-25'
method: probed
source: >-
  Live TLS handshakes, HTTP HEAD and dig queries against every host in apis.yml
  plus the JWKS host advertised by the d ACCOUNT Connect discovery document.
  Probed 2026-07-25. The registrable domain was corrected by hand to
  docomo.ne.jp — ne.jp is a Japanese second-level generic, not a registrable
  domain, and the automated pass had queried it. id.smt.docomo.ne.jp was also
  re-probed by hand: the automated pass recorded https:false because its
  handshake fails under a default OpenSSL 3 context (see below), not because
  the host lacks HTTPS.
description: >-
  Transport and DNS security posture for NTT DOCOMO, Inc.'s public hosts. The
  headline finding is a split: the corporate host and the OIDC issuer negotiate
  TLS 1.3, but id.smt.docomo.ne.jp — the d ACCOUNT authorization endpoint host,
  where roughly 90 million users authenticate — caps at TLS 1.2, serves no HSTS,
  and rejects RFC 5746 secure renegotiation. Neither docomo.ne.jp nor
  nttdocomo.co.jp is DNSSEC-signed or publishes a CAA record.
hosts:
- host: www.docomo.ne.jp
  role: Corporate site and surviving public developer information page
  https: true
  tls_version: TLSv1.3
  http_version: HTTP/2
  cert_issuer: GlobalSign nv-sa
  cert_expires: Oct 19 04:19:21 2026 GMT
  hsts: true
  hsts_max_age: 15768000
  hsts_include_subdomains: false
  hsts_preload: false
- host: conf.uw.docomo.ne.jp
  role: d ACCOUNT Connect OpenID Provider (issuer, token, userinfo)
  https: true
  tls_version: TLSv1.3
  http_version: HTTP/2
  cert_issuer: DigiCert Inc
  cert_expires: Sep 30 23:59:59 2026 GMT
  hsts: false
  notes: >-
    Fronted by CloudFront over an AWS API Gateway origin (server openresty,
    apigw-requestid and x-amz-cf-id response headers). Returns 403 to every
    path except /.well-known/openid-configuration.
- host: id.smt.docomo.ne.jp
  role: d ACCOUNT authorization endpoint and business documentation host
  https: true
  tls_version: TLSv1.2
  tls13_supported: false
  http_version: HTTP/1.1
  cert_issuer: GlobalSign nv-sa (GlobalSign RSA OV SSL CA 2018)
  cert_subject: C=JP, ST=Tokyo, L=Chiyoda-Ku, O=NTT DOCOMO.INC, CN=id.smt.docomo.ne.jp
  cert_expires: Sep 30 14:59:59 2026 GMT
  hsts: false
  secure_renegotiation: false
  notes: >-
    TLS 1.3 handshake fails (curl --tlsv1.3 --tls-max 1.3 returns no response);
    TLS 1.2 succeeds and serves HTTP 200. The server does not advertise the
    RFC 5746 renegotiation_info extension, so a default OpenSSL 3 client
    refuses the connection with UNSAFE_LEGACY_RENEGOTIATION_DISABLED. This is
    the host that carries the OIDC authorization endpoint /cgi8/oidc/authorize.
- host: fr-end.oidc.if.cilite.docomo.ne.jp
  role: JWKS host for d ACCOUNT Connect
  https: true
  tls_version: TLSv1.3
  http_version: HTTP/2
  cert_issuer: GlobalSign nv-sa
  cert_expires: Sep 30 14:59:59 2026 GMT
  hsts: false
domains:
- domain: docomo.ne.jp
  dnssec: false
  caa: []
  spf: true
  spf_policy: '~all'
  spf_record: >-
    v=spf1 +ip4:203.138.203.0/24 +ip4:210.153.87.192/29 +ip4:210.153.87.224/29
    +ip4:202.212.37.97 +ip4:202.212.37.98 +ip4:202.212.37.100
    +ip4:202.212.37.113 +ip4:202.212.37.103 +ip4:202.212.37.104
    +ip4:1.73.231.0/26 +ip4:1.75.151.128/25 +ip4:1.75.146.128/25
    +ip4:49.102.168.0/21 ~all
  dmarc: true
  dmarc_policy: quarantine
  dmarc_subdomain_policy: reject
  dmarc_pct: 100
  dmarc_rua: mailto:docomo00001-ra@dmarc25.jp
- domain: nttdocomo.co.jp
  dnssec: false
  caa: []
  spf: true
  spf_policy: '~all'
  dmarc: true
  dmarc_policy: none
  dmarc_subdomain_policy: none
  dmarc_pct: 100
  dmarc_rua: mailto:dm0mlsugqaev8.rua@dp.smtps.jp
  notes: >-
    The corporate domain runs DMARC in monitor mode (p=none) while the
    consumer/service domain enforces quarantine with sp=reject.
findings:
- severity: notable
  finding: >-
    id.smt.docomo.ne.jp — the d ACCOUNT authorization endpoint host — does not
    support TLS 1.3, sends no HSTS header, and lacks RFC 5746 secure
    renegotiation.
- severity: notable
  finding: >-
    No CAA records on either registrable domain, so no certificate-authority
    issuance restriction is published.
- severity: notable
  finding: No DNSSEC on docomo.ne.jp or nttdocomo.co.jp.
- severity: informational
  finding: >-
    HSTS is present only on www.docomo.ne.jp, with a six-month max-age and
    neither includeSubDomains nor preload, so it does not protect the identity
    hosts.