Stotles · Domain Security

Stotles Domain Security

Domain security

Domain security posture for Stotles, probed live across 2 host(s) and 1 registrable domain(s). 2 host(s) serve HTTPS (up to TLSv1.3); 1 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=quarantine).

CompanyProcurementPublic SectorGovernmentTendersSales IntelligenceB2GMarket IntelligenceAPIOpenAPIMCPAgent NativeContract AwardsFramework AgreementsCPVUnited KingdomIrelandGovTech

Transport & Host Security

www.stotles.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 30 23:59:59 2026 GMT
api.stotles.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Dec 26 23:59:59 2026 GMT

Domain (DNS/Email) Security

stotles.com
DNSSEC: no · SPF: yes · DMARC: yes (p=quarantine) · CAA: none

Source

Domain Security

Raw ↑ 
generated: '2026-08-14'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.stotles.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 30 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.stotles.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 26 23:59:59 2026 GMT
  hsts: null
domains:
- domain: stotles.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
findings:
- id: api-host-no-hsts
  severity: medium
  detail: >-
    api.stotles.com — the production API host and the MCP endpoint host — returns NO
    Strict-Transport-Security header, while www.stotles.com sets one with max-age=31536000. A client
    that first reaches the API over plain HTTP is not pinned to HTTPS for subsequent requests. This
    matters more than usual here because authentication is a long-lived static `x-api-key` header:
    a single downgraded request leaks the organization's key.
  observed: '2026-08-14'
- id: no-dnssec
  severity: low
  detail: stotles.com is not DNSSEC-signed.
  observed: '2026-08-14'
- id: no-caa
  severity: low
  detail: >-
    No CAA records are published for stotles.com, so no certificate authority is constrained from
    issuing for the domain.
  observed: '2026-08-14'
- id: dmarc-quarantine-not-reject
  severity: low
  detail: DMARC policy is p=quarantine rather than p=reject.
  observed: '2026-08-14'