Centrica · Domain Security

Centrica Domain Security

Domain security

Domain security posture for Centrica, probed live across 4 host(s) and 4 registrable domain(s). 4 host(s) serve HTTPS (up to TLSv1.3); 3 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=reject).

EnergyUnited KingdomUtilitiesElectricityGasSmart MeteringEnergy RetailEnergy MarketsIrelandField Service

Transport & Host Security

www.centrica.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 10 16:56:03 2026 GMT
api-developer.dev.fieldops.centrica.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 10 11:18:52 2026 GMT
api.dev.fieldops.centrica.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Sep 10 11:18:52 2026 GMT
www.britishgas.co.uk
HTTPS: yes · HSTS: yes · cert expires: Oct 26 23:59:59 2026 GMT

Domain (DNS/Email) Security

centrica.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
britishgas.co.uk
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
bordgaisenergy.ie
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
hivehome.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none

Source

Domain Security

Raw ↑ 
generated: '2026-07-27'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.centrica.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 10 16:56:03 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api-developer.dev.fieldops.centrica.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 10 11:18:52 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.dev.fieldops.centrica.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 10 11:18:52 2026 GMT
  hsts: null
- host: www.britishgas.co.uk
  https: true
  cert_expires: Oct 26 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
domains:
- domain: centrica.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: britishgas.co.uk
  dnssec: false
  caa: []
  spf: true
  spf_policy: softfail
  dmarc: true
  dmarc_policy: reject
- domain: bordgaisenergy.ie
  dnssec: false
  caa: []
  spf: true
  spf_policy: fail
  dmarc: true
  dmarc_policy: reject
- domain: hivehome.com
  dnssec: false
  caa: []
  spf: true
  spf_policy: softfail
  dmarc: true
  dmarc_policy: reject
notes: >-
  Added on the 2026-07-27 enrichment round: the British Gas retail host and the three
  sibling brand domains (britishgas.co.uk, bordgaisenergy.ie, hivehome.com) were probed
  by hand because they carry the group's public surface but are not apis.yml baseURL hosts.
  All four registrable domains share the same posture — DMARC p=reject with Valimail
  aggregate reporting, SPF present, no CAA records published and no DNSSEC. TLS 1.3 and a
  one-year HSTS max-age on every reachable web host; the FieldOps development gateway
  (api.dev.fieldops.centrica.com) is the only host that sends no HSTS header.