Bupa · Domain Security

Bupa Domain Security

Domain security

Domain security posture for Bupa, probed live across 6 host(s) and 4 registrable domain(s). 6 host(s) serve HTTPS (up to TLSv1.3); 5 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=reject).

InsuranceUnited KingdomHealth InsuranceLife and HealthCarrierHealthcareAged CareClaimsPolicy AdministrationPartner Gated

Transport & Host Security

www.bupa.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Dec 12 13:51:15 2026 GMT
portal.api.bupa.com.au
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Dec 3 23:59:59 2026 GMT
api.bupa.com.au
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Dec 3 23:59:59 2026 GMT
apidoc.bupa.cl
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Jan 28 14:56:29 2027 GMT
api.bupa.cl
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Jan 28 14:56:29 2027 GMT
www.bupa.co.uk
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Feb 6 09:47:07 2027 GMT

Domain (DNS/Email) Security

bupa.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
bupa.com.au
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
bupa.cl
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: yes
bupa.co.uk
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none

Source

Domain Security

bupa-domain-security.yml Raw ↑ 
generated: '2026-07-25'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + market-unit API hosts
note: >-
  Probed with 0-working/probe-domain-security.py for the group and Bupa
  Australia hosts, then extended by hand for the Bupa Chile and Bupa UK market
  units (openssl s_client for TLS, curl -I for HSTS, dig for CAA/SPF/DMARC/
  DNSKEY), which the script does not reach from a baseURL walk. Absence of a
  record is recorded as absence, not as an error.
hosts:
- host: www.bupa.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 12 13:51:15 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: portal.api.bupa.com.au
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec  3 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.bupa.com.au
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec  3 23:59:59 2026 GMT
  hsts: null
  note: >-
    Imperva-fronted APIM gateway; returns HTTP 502 to anonymous callers, so no
    HSTS header is observable from an unauthenticated request.
- host: apidoc.bupa.cl
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan 28 14:56:29 2027 GMT
  hsts: true
  hsts_max_age: 15552000
  hsts_include_subdomains: true
- host: api.bupa.cl
  https: true
  tls_version: TLSv1.3
  cert_expires: Jan 28 14:56:29 2027 GMT
  hsts: true
  hsts_max_age: 15552000
  hsts_include_subdomains: true
- host: www.bupa.co.uk
  https: true
  tls_version: TLSv1.3
  cert_expires: Feb  6 09:47:07 2027 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_preload: true
domains:
- domain: bupa.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: bupa.com.au
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: bupa.cl
  dnssec: false
  caa:
  - 0 issue "pki.goog"
  - 0 issue "globalsign.com"
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: bupa.co.uk
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
summary:
  hosts_probed: 6
  https_everywhere: true
  tls13_everywhere: true
  hsts_hosts: 5
  domains_probed: 4
  dnssec_domains: 0
  caa_domains: 1
  spf_domains: 4
  dmarc_reject_domains: 4