generated: '2026-07-28'
method: probed
source: >-
  Live DNS/TLS/HTTP probes of every apis.yml host on 2026-07-28, run with
  0-working/probe-domain-security.py and then extended by hand to cover the
  geospatial and bulk-file hosts the script does not read out of apis.yml
  (maps-cartes.services.geo.ca, opendatatc.tc.canada.ca) and to verify the
  data.tc.gc.ca chain finding with openssl s_client.
hosts:
- host: tc.canada.ca
  role: departmental website
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct 18 02:15:03 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: open.canada.ca
  role: open data portal + CKAN Action API (Treasury Board Secretariat)
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 15 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: data.tc.gc.ca
  role: Vehicle Recalls Database API host
  https: true
  tls_version: TLSv1.2
  cert_issuer: C=US, O=SSL Corporation, CN=Entrust OV TLS Issuing RSA CA 1
  cert_subject: C=CA, ST=Quebec, L=Gatineau, O=Shared Services Canada, CN=data.tc.gc.ca
  cert_expires: Sep 25 04:00:00 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_directives: includeSubDomains; preload
  chain_complete: false
  finding: >-
    The server sends the leaf certificate only and does not send the Entrust
    intermediate. openssl s_client returns "verify error:num=20:unable to get
    local issuer certificate" and "Verify return code: 21 (unable to verify the
    first certificate)". Clients that happen to have the intermediate cached
    (macOS keychain, most browsers) connect fine; a clean client, a container,
    or a language runtime using only a root bundle will fail TLS verification
    against Transport Canada's only first-party API host. Verified twice —
    Python ssl and openssl s_client both fail, curl on macOS succeeds.
- host: maps-cartes.services.geo.ca
  role: Canadian Airports ArcGIS REST + OGC WMS host (NRCan Federal Geospatial Platform)
  https: true
  tls_version: TLSv1.2
  cert_issuer: C=US, O=Amazon, CN=Amazon RSA 2048 M04
  cert_expires: Feb  2 23:59:59 2027 GMT
  chain_complete: true
  hsts: false
  note: >-
    Verify return code 0 (ok). No Strict-Transport-Security header on the root
    (the root answers 301). Hosted on AWS, unlike the departmental estate.
- host: opendatatc.tc.canada.ca
  role: bulk CSV/XML distribution host
  https: true
  cert_issuer: C=US, O=Let's Encrypt, CN=YR1
  cert_expires: Oct 18 02:15:03 2026 GMT
  chain_complete: true
  hsts: false
  note: >-
    No HSTS header observed. This host carries the CADORS, vehicle recall, Air
    Cargo Security and vessel register extracts — the de facto primary
    distribution channel for Transport Canada data.
domains:
- domain: canada.ca
  dnssec: false
  caa: []
  spf: true
  spf_record: v=spf1 include:emrs._spf.ssc-spc.gc.ca include:spf.protection.outlook.com include:slms._spf.ssc-spc.gc.ca -all
  dmarc: true
  dmarc_policy: none
  dmarc_record: v=DMARC1; p=none; rua=mailto:ssc.dmarc.spc@canada.ca,mailto:dmarc@cyber.gc.ca; adkim=s; aspf=s
  note: >-
    Strict alignment (adkim=s, aspf=s) but the policy is still p=none, so no
    enforcement. Aggregate reports go to Shared Services Canada and to the
    Canadian Centre for Cyber Security.
- domain: gc.ca
  dnssec: false
  caa: []
  spf: true
  spf_record: v=spf1 mx include:spf.protection.outlook.com -all
  dmarc: true
  dmarc_policy: none
  dmarc_record: v=DMARC1; p=none; sp=none; rua=mailto:dmarc@cyber.gc.ca
  note: The API host data.tc.gc.ca sits under this domain.
- domain: geo.ca
  dnssec: false
  caa: []
  spf: true
  spf_record: v=spf1 -all
  dmarc: true
  dmarc_policy: reject
  dmarc_record: v=DMARC1; p=reject;rua=mailto:nrcan.gcc-notifications-notifications-ncg.rncan@canada.ca
  note: >-
    The only enforcing DMARC policy in the set — and it belongs to Natural
    Resources Canada's geospatial platform, not to Transport Canada.
summary:
  https_everywhere: true
  tls13: 1 of 5 hosts (open.canada.ca)
  hsts: 3 of 5 hosts
  dnssec: 0 of 3 domains
  caa: 0 of 3 domains
  dmarc_enforcing: 1 of 3 domains (geo.ca, p=reject)
  notable: >-
    Two findings stand out. First, data.tc.gc.ca — the department's only
    first-party API host — serves an incomplete certificate chain. Second, no
    domain in the estate publishes CAA records or DNSSEC, and the two
    Government of Canada apex domains carry non-enforcing DMARC (p=none).