Definity Financial · Domain Security

Definity Financial Domain Security

Domain security

Domain security posture for Definity Financial, probed live across 6 host(s) and 5 registrable domain(s). 6 host(s) serve HTTPS (up to TLSv1.3); 6 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=none).

InsuranceCanadaProperty and CasualtyCarrierUnderwritingClaimsBrokerPet InsuranceDirect to ConsumerPartner GatedCSIOInsurtech

Transport & Host Security

www.definityfinancial.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 19 14:22:17 2026 GMT
www.economical.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 12 23:59:59 2026 GMT
www.sonnet.ca
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Nov 16 23:59:59 2026 GMT
www.petsecure.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Feb 6 23:59:59 2027 GMT
api.definity.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Dec 31 23:59:59 2026 GMT
broker.economical.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Oct 6 23:59:59 2026 GMT

Domain (DNS/Email) Security

definityfinancial.com
DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none
economical.com
DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none
sonnet.ca
DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none
petsecure.com
DNSSEC: no · SPF: yes · DMARC: yes (p=quarantine) · CAA: none
definity.com
DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none

Source

Domain Security

definity-financial-domain-security.yml Raw ↑ 
generated: '2026-07-25'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.definityfinancial.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 19 14:22:17 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: www.economical.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 12 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31557600
- host: www.sonnet.ca
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 16 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 3600
- host: www.petsecure.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Feb  6 23:59:59 2027 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.definity.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 31 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  note: Partner/production gateway. Imperva-fronted; HTTP 404 with empty body to all anonymous paths.
- host: broker.economical.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  6 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  note: Docebo SaaS learning management system for broker training (CNAME economical.docebosaas.com).
domains:
- domain: definityfinancial.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
- domain: economical.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
- domain: sonnet.ca
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
- domain: petsecure.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
- domain: definity.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
  note: >-
    SPF record names the third-party services fronting Definity's mail and broker estate,
    including spf.acturis.com (Acturis broker management system), docebosaas.com (broker
    LMS), service-now.com, salesforce.com, sendgrid.net and spf.protection.outlook.com.
findings:
- No domain in the estate publishes DNSSEC.
- No domain in the estate publishes a CAA record.
- All five domains publish SPF with a -all hard fail.
- >-
  DMARC is published everywhere but four of five domains sit at p=none (monitor only);
  only petsecure.com enforces at p=quarantine. No domain reaches p=reject.
- All six probed hosts serve TLS 1.3 with HSTS; only broker.economical.com sets includeSubDomains.
extended_probe:
  method: probed
  source: >-
    dig against 8.8.8.8 plus openssl s_client and HEAD requests, run 2026-07-25 to cover the
    petsecure.com, api.definity.com, broker.economical.com and definity.com surfaces that the
    apis.yml-driven pass did not reach.