Steadfast Group Domain Security

generated: '2026-07-25'
method: probed
source: >-
  live DNS/TLS/HTTP probes of every Steadfast Group host in apis.yml, the OpenAPI servers, and
  the additional hosts discovered through certificate transparency, run 2026-07-25
hosts:
- host: www.steadfast.com.au
  role: Corporate and consumer marketing site
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 11 16:10:21 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: floodrisktracker.steadfast.com.au
  role: Public Flood Risk Tracker tool and the estate's only public API
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct  2 14:58:09 2026 GMT
  hsts: true
  hsts_max_age: 2592000
  hsts_include_subdomains: false
  hsts_preload: false
  note: >-
    30-day HSTS max-age, below the one-year threshold required for preload eligibility. Fronted
    by Cloudflare. Additional response headers observed - x-content-type-options nosniff,
    x-frame-options sameorigin, x-xss-protection 1; mode=block, and x-powered-by ASP.NET, which
    discloses the server stack unnecessarily.
- host: idp.steadfast.com.au
  role: Okta-hosted OpenID Connect identity provider
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct 22 11:49:51 2026 GMT
  hsts: true
  hsts_max_age: 315360000
  hsts_include_subdomains: true
  note: Ten-year HSTS with includeSubDomains - the strongest transport posture in the estate.
- host: broker.steadfast.com.au
  role: Credentialed broker portal (Optimizely/Episerver DXP)
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 13 08:47:31 2026 GMT
  hsts: false
  note: >-
    No Strict-Transport-Security header on the login wall used by 414 member brokerages. This is
    the most consequential gap found in the estate.
- host: api.steadfast.com.au
  role: Undocumented partner API host (403 at root)
  https: true
  tls_version: TLSv1.2
  cert_expires: Oct  9 23:59:59 2026 GMT
  hsts: false
- host: api-sf.steadfast.com.au
  role: Partner API host discovered via certificate transparency (403 at root)
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 17 23:59:59 2026 GMT
  hsts: false
- host: investor.steadfast.com.au
  role: Investor relations platform (third party)
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 24 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: true
- host: steadfastagencies.com.au
  role: Steadfast Underwriting Agencies
  https: true
  tls_version: TLSv1.2
  cert_expires: Sep 27 01:47:09 2026 GMT
  hsts: true
  hsts_max_age: 2592000
- host: www.steadfastlife.com.au
  role: Steadfast Life
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  7 00:51:27 2026 GMT
  hsts: true
  hsts_max_age: 63072000
- host: www.steadfastnz.nz
  role: Steadfast New Zealand
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 10 06:27:31 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: www.steadfast.com.sg
  role: Steadfast Singapore
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 12 01:55:40 2026 GMT
  hsts: true
  hsts_max_age: 31536000
domains:
- domain: steadfast.com.au
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
  note: DMARC is at p=reject with aggregate and forensic reporting via vali.email - a strong email posture.
- domain: steadfastagencies.com.au
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: steadfastlife.com.au
  dnssec: true
  caa:
  - 0 issue "comodoca.com"
  - 0 issue "digicert.com; cansignhttpexchanges=yes"
  - 0 issue "letsencrypt.org"
  - 0 issue "pki.goog; cansignhttpexchanges=yes"
  - 0 issue "ssl.com"
  - 0 issuewild "comodoca.com"
  - 0 issuewild "digicert.com; cansignhttpexchanges=yes"
  - 0 issuewild "letsencrypt.org"
  - 0 issuewild "pki.goog; cansignhttpexchanges=yes"
  - 0 issuewild "ssl.com"
  spf: true
  dmarc: true
  dmarc_policy: quarantine
  note: >-
    The only Steadfast domain with DNSSEC signing and CAA records - and it is a divisional site,
    not the primary domain. The divergence suggests it sits with a different registrar/host than
    the corporate estate.
- domain: steadfastnz.nz
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: steadfast.com.sg
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
findings:
- >-
  Email authentication is consistently strong: SPF everywhere and DMARC at p=reject on four of
  five domains - a meaningful control for a broker network exposed to invoice and premium fraud.
- >-
  DNSSEC and CAA are absent on the primary steadfast.com.au domain and on every domain except
  steadfastlife.com.au. Nothing constrains which certificate authority may issue for the
  corporate or API hosts.
- >-
  HSTS is inconsistent across the estate, ranging from ten years with includeSubDomains on the
  identity provider to entirely absent on the broker login wall and both partner API hosts.
- >-
  Two hosts still negotiate TLS 1.2 as their top protocol, including the public API host and the
  identity provider.