Sofi Technologies Domain Security

generated: '2026-09-06'
method: probed
source: >-
  live DNS/TLS/HTTP probes of the hosts this record names, run by
  0-working/probe-domain-security.py and then hand-corrected to drop two rows the script derived
  from placeholder server values - see excluded below.
hosts:
  - host: www.sofi.com
    https: true
    tls_version: TLSv1.3
    cert_expires: Dec  8 23:40:23 2026 GMT
    hsts: null
    note: >-
      Answers 403 to any non-browser client (Cloudflare bot challenge) while serving a real 317 KB
      page. Live, not dead.
  - host: tech.sofi.com
    https: true
    tls_version: TLSv1.3
    cert_expires: Oct  8 22:20:35 2026 GMT
    hsts: true
    hsts_max_age: 31536000
    hsts_include_subdomains: true
  - host: docs.tech.sofi.com
    https: true
    tls_version: TLSv1.3
    cert_expires: Oct 13 00:06:15 2026 GMT
    hsts: true
    hsts_max_age: 31536000
  - host: api.sofi.com
    https: true
    tls_version: TLSv1.3
    cert_expires: Dec  8 23:40:23 2026 GMT
    hsts: true
    hsts_max_age: 31536000
    hsts_include_subdomains: true
    note: Live nginx behind Cloudflare; every probed path returns 404. No public contract here.
  - host: sandbox.gpsrv.com
    https: true
    tls_version: TLSv1.3
    cert_expires: Oct 18 02:13:14 2026 GMT
    hsts: true
    hsts_max_age: 63072000
    hsts_include_subdomains: true
    note: The Sandbox dashboard where clients read their Sandbox API connection details.
  - host: sandbox-api.gpsrv.com
    https: unknown
    note: >-
      TCP connect times out from an arbitrary source. The Sandbox API host is IP-allowlisted, which
      is consistent with credentials being bound to a registered requesting IP.
  - host: developer.sofi.com
    https: false
    note: >-
      NXDOMAIN. This host was the humanURL on this record before 2026-09-06 and never existed; the
      pointer has been removed.
domains:
  - domain: sofi.com
    dnssec: false
    caa:
      - 0 issue "pki.goog"
      - 0 issue "amazon.com"
      - 0 issuewild "amazon.com"
      - 0 issuewild "globalsign.com"
      - 0 issuewild "godaddy.com"
      - 0 issuewild "pki.goog"
    spf: true
    dmarc: true
    dmarc_policy: reject
  - domain: gpsrv.com
    dnssec: false
    caa: []
    spf: true
    dmarc: true
    dmarc_policy: none
    note: >-
      The legacy Galileo processing domain that still hosts every API server template. DMARC is
      p=none - monitor only, no enforcement - on the domain that carries the platform's entire
      callable surface, while sofi.com itself is at p=reject. Mail is behind Proofpoint.
excluded:
  - value: client.domain.com
    reason: >-
      Not a SoFi host. It is the placeholder server in the Events API and External Trans API
      contracts, where the CLIENT hosts the endpoint. The automated probe treated it as a real
      host and would have recorded a third party's SPF and DMARC posture as SoFi's.
  - value: example.client.domain.com
    reason: Same - the Auth API's client-hosted placeholder server.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com