GitHub Copilot · Domain Security

Github Copilot Domain Security

Domain security

Domain security posture for GitHub Copilot, probed live across 4 host(s) and 2 registrable domain(s). 4 host(s) serve HTTPS (up to TLSv1.3); 3 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=quarantine).

AgentsAIArtificial IntelligenceCode GenerationCode ReviewCoding AgentCustom InstructionsDeveloper ToolsExtensionsIDEMachine LearningMCPMetricsModel Context ProtocolProductivity

Transport & Host Security

api.github.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes
github.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes
docs.github.com
HTTPS: yes · HSTS: yes
api.githubcopilot.com
HTTPS: yes · HSTS: no

Domain (DNS/Email) Security

github.com
DNSSEC: no · SPF: yes · DMARC: yes (p=quarantine) · CAA: yes
githubcopilot.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: yes

Source

Domain Security

Raw ↑ 
generated: '2026-06-20'
method: probed
source: >-
  Live DNS/TLS/HTTP probes of the GitHub API and web hosts (2026-06-20). The
  mechanical probe-domain-security.py excludes github.com as a code host, so
  these hosts were probed manually with dig + openssl/curl. Absence of a record
  (e.g. no DNSSEC) is valid recorded data.
hosts:
  - {host: api.github.com, https: true, tls_version: TLSv1.3, hsts: true, hsts_max_age: 31536000, hsts_preload: true, cert_not_after: '2026-09-29'}
  - {host: github.com, https: true, tls_version: TLSv1.3, hsts: true, hsts_max_age: 31536000, hsts_preload: true, cert_not_after: '2026-09-30'}
  - {host: docs.github.com, https: true, hsts: true, hsts_max_age: 31557600, cert_not_after: '2026-09-02'}
  - {host: api.githubcopilot.com, https: true, http_status: 404, cert_not_after: '2026-08-30', note: 'Copilot API / MCP host; root returns 404, endpoints require auth.'}
domains:
  - domain: github.com
    dnssec: false
    caa: ['issue digicert.com', 'issue globalsign.com', 'issue letsencrypt.org', 'issue sectigo.com', 'issuewild digicert.com', 'issuewild letsencrypt.org', 'issuewild sectigo.com']
    spf: true
    dmarc: true
    dmarc_policy: quarantine
    dmarc_subdomain_policy: reject
  - domain: githubcopilot.com
    dnssec: false
    caa: ['issue digicert.com', 'issue letsencrypt.org (dns-01)', 'issue sectigo.com', 'issuewild digicert.com', 'issuewild sectigo.com']
    spf: true
    spf_policy: '-all (hard fail)'
    dmarc: true
    dmarc_policy: reject
notes: >-
  All probed hosts serve TLS 1.3 with HSTS + preload. Both registrable domains
  publish CAA (restricting issuance to DigiCert/GlobalSign/Let's Encrypt/Sectigo),
  SPF, and DMARC; githubcopilot.com enforces the strictest posture (SPF -all,
  DMARC p=reject). Neither domain has DNSSEC (DS record absent).