América Móvil · Domain Security

America Movil Domain Security

Domain security

Domain security posture for América Móvil, probed live across 6 host(s) and 4 registrable domain(s). 6 host(s) serve HTTPS (up to TLSv1.3); 2 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=reject).

TelecommunicationsMexicoLatin AmericaMobile Network OperatorNetwork APIsCAMARAOpen GatewaySIM SwapIdentity VerificationDevice LocationBroadband5GCarrier

Transport & Host Security

www.americamovil.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Oct 19 08:08:32 2026 GMT
www.telcel.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Aug 8 23:59:59 2026 GMT
www.claro.com.br
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Jan 6 23:59:59 2027 GMT
api.claro.com.br
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Jan 6 23:59:59 2027 GMT
api-sandbox.claro.com.br
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Jan 6 23:59:59 2027 GMT
www.claroinsight.com.br
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Jan 11 23:59:59 2027 GMT

Domain (DNS/Email) Security

americamovil.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
telcel.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
claro.com.br
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
claroinsight.com.br
DNSSEC: no · SPF: yes · DMARC: no · CAA: none

Source

Domain Security

Raw ↑ 
generated: '2026-07-25'
method: probed
source: >-
  live DNS/TLS/HTTP probes of every apis.yml host and every OpenAPI servers[]
  host, extended by hand to cover the API edge, the sandbox edge, the developer
  marketplace and the .com.br registrable domains the automated pass skipped.
hosts:
- host: www.americamovil.com
  role: corporate / investor relations
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 19 08:08:32 2026 GMT
  hsts: false
- host: www.telcel.com
  role: Mexico operating company
  https: true
  tls_version: TLSv1.3
  cert_expires: Aug  8 23:59:59 2026 GMT
  hsts: null
- host: www.claro.com.br
  role: Brazil operating company
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan  6 23:59:59 2027 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.claro.com.br
  role: production API gateway edge (CloudFront)
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan  6 23:59:59 2027 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  anonymous_status: 403
- host: api-sandbox.claro.com.br
  role: sandbox API edge
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan  6 23:59:59 2027 GMT
  hsts: false
  anonymous_status: 404
- host: www.claroinsight.com.br
  role: Claro Insight API marketplace (the group's only developer portal)
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan 11 23:59:59 2027 GMT
  hsts: false
  anonymous_status: 200
domains:
- domain: americamovil.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: telcel.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: claro.com.br
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
  dmarc_note: 'pct=100, fo=1, rua/ruf reporting to OnDMARC and Cisco DMP'
- domain: claroinsight.com.br
  dnssec: false
  caa: []
  spf: true
  dmarc: false
  dmarc_note: >-
    No _dmarc record. The domain that hosts the developer marketplace, the
    registration flow and the login is the one domain in the estate with no DMARC
    policy — a phishing surface aimed squarely at API customers.
observations:
- Strong e-mail authentication on the brand domains (SPF + DMARC p=reject) but none on claroinsight.com.br.
- No CAA record on any domain — any CA may issue for these names.
- No DNSSEC anywhere in the estate.
- HSTS is enforced on the production API edge and the Brazilian consumer site, but not on the sandbox edge or the developer marketplace.