Sofi Technologies Domain Security

generated: '2026-09-06'
method: probed
source: live DNS/TLS/HTTP probes of the hosts this record names, run by 0-working/probe-domain-security.py
  and then hand-corrected to drop two rows the script derived from placeholder server values - see excluded
  below.
hosts:
- host: www.sofi.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec  8 23:40:23 2026 GMT
  hsts: null
  note: Answers 403 to any non-browser client (Cloudflare bot challenge) while serving a real 317 KB page.
    Live, not dead.
- host: tech.sofi.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  8 22:20:35 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: docs.tech.sofi.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 13 00:06:15 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.sofi.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec  8 23:40:23 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  note: Live nginx behind Cloudflare; every probed path returns 404. No public contract here.
- host: sandbox.gpsrv.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 18 02:13:14 2026 GMT
  hsts: true
  hsts_max_age: 63072000
  hsts_include_subdomains: true
  note: The Sandbox dashboard where clients read their Sandbox API connection details.
- host: sandbox-api.gpsrv.com
  https: null
  note: TCP connect times out from an arbitrary source. The Sandbox API host is IP-allowlisted, which
    is consistent with credentials being bound to a registered requesting IP.
  https_note: unknown - not determinable from probe
- host: developer.sofi.com
  https: false
  note: NXDOMAIN. This host was the humanURL on this record before 2026-09-06 and never existed; the pointer
    has been removed.
domains:
- domain: sofi.com
  dnssec: false
  caa:
  - 0 issue "pki.goog"
  - 0 issue "amazon.com"
  - 0 issuewild "amazon.com"
  - 0 issuewild "globalsign.com"
  - 0 issuewild "godaddy.com"
  - 0 issuewild "pki.goog"
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: gpsrv.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
  note: The legacy Galileo processing domain that still hosts every API server template. DMARC is p=none
    - monitor only, no enforcement - on the domain that carries the platform's entire callable surface,
    while sofi.com itself is at p=reject. Mail is behind Proofpoint.
excluded:
- value: client.domain.com
  reason: Not a SoFi host. It is the placeholder server in the Events API and External Trans API contracts,
    where the CLIENT hosts the endpoint. The automated probe treated it as a real host and would have
    recorded a third party's SPF and DMARC posture as SoFi's.
- value: example.client.domain.com
  reason: Same - the Auth API's client-hosted placeholder server.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com