generated: '2026-07-26'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.remax.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 12 23:59:59 2026 GMT
  hsts: null
- host: www.remax.eu
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 15 04:19:21 2026 GMT
  hsts: false
- host: apidocs.datahub.remax.eu
  https: true
  tls_version: TLSv1.3
  cert_expires: Aug 30 03:54:38 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: listingsapi-test.datahub.remax.eu
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 11 22:50:38 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: true
  note: Postman-hosted documentation; the strongest transport posture in the estate
- host: api.datahub.remax.eu
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct 12 23:59:59 2026 GMT
  hsts: false
  note: the production Datahub API host negotiates TLS 1.2 and sets no HSTS
- host: oauth.datahub.remax.eu
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct 12 23:59:59 2026 GMT
  hsts: false
  note: >-
    the OAuth authorization server negotiates TLS 1.2 and sets no HSTS, while
    also carrying tokens in query strings
- host: datahub.remax.eu
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct  2 23:59:59 2026 GMT
  hsts: false
- host: listing-api-remaxeu.bwscloud.tech
  https: true
  tls_version: TLSv1.2
  cert_expires: Nov 19 23:59:59 2026 GMT
  hsts: false
  note: staging Listings API on a third-party vendor domain, outside RE/MAX DNS control
domains:
- domain: remax.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
- domain: remax.eu
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
observations:
- >-
  No CAA records on either registrable domain, so any public CA may issue for
  remax.com or remax.eu.
- >-
  No DNSSEC on either domain.
- >-
  DMARC is enforced only at p=quarantine, not p=reject, on both domains.
- >-
  remax.com serves a DNS wildcard (CNAME customers.kvcore.com). The control probe
  zzzznotreal.remax.com resolves identically to developer.remax.com,
  developers.remax.com, docs.remax.com, status.remax.com and trust.remax.com -
  none of those hostnames is a service RE/MAX runs. A wildcard that answers on
  443 for every conceivable subdomain is itself a security-relevant posture
  (subdomain-confusion and phishing surface).
- >-
  api.remax.com is a dangling CNAME to api.remax-prod.booj.io, which returns
  NXDOMAIN - a classic subdomain-takeover shape left behind by the decommissioned
  booj platform.
- >-
  The API and OAuth hosts negotiate TLS 1.2 and set no HSTS, while the two
  Postman documentation hosts (which carry no data) are TLS 1.3 with HSTS
  preload. The transport hardening is inverted relative to where the risk is.
programs:
  security_txt: absent on every host probed
  vulnerability_disclosure: none published
  trust_center: >-
    none. trust.remax.com answers 403 only because of the remax.com wildcard; it
    is not a trust center.
  probe: 0-working/probe-security-programs.py returned vdp=none trust=none (2026-07-26)