Tegus · Domain Security

Tegus Domain Security

Domain security

Domain security posture for Tegus, probed live across 3 host(s) and 2 registrable domain(s). 3 host(s) serve HTTPS (up to TLSv1.3); 3 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=reject).

Investment ResearchExpert NetworksMarket IntelligenceFinancial DataTranscriptsPrivate MarketsEquity ResearchOpenID ConnectAcquired

Transport & Host Security

www.tegus.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 12 17:37:17 2026 GMT
auth.tegus.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Oct 7 23:28:05 2026 GMT
app.tegus.co
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Aug 23 23:56:48 2026 GMT

Domain (DNS/Email) Security

tegus.com
DNSSEC: no · SPF: yes · DMARC: yes (p=reject) · CAA: none
tegus.co
DNSSEC: no · SPF: yes · DMARC: yes (p=quarantine) · CAA: none

Source

Domain Security

tegus-domain-security.yml Raw ↑ 
generated: '2026-08-05'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.tegus.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 12 17:37:17 2026 GMT
  hsts: true
  hsts_max_age: 63072000
- host: auth.tegus.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  7 23:28:05 2026 GMT
  hsts: true
  hsts_max_age: 63072000
- host: app.tegus.co
  https: true
  tls_version: TLSv1.3
  cert_expires: Aug 23 23:56:48 2026 GMT
  hsts: true
  hsts_max_age: 300
  http_status: 403
  note: >-
    The live Tegus application. HSTS max-age is 300 seconds — two orders of magnitude
    below the 63072000 used on tegus.com and below the 31536000 an HSTS preload requires.
    Root returns 403 from Fastly/Varnish with a PerimeterX `_pxhd` cookie (bot challenge).
domains:
- domain: tegus.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: reject
- domain: tegus.co
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
  dmarc_pct: 10
  note: >-
    The application domain. DMARC is p=quarantine at pct=10 — only a tenth of failing
    mail is quarantined — against p=reject on tegus.com. No CAA and no DNSSEC on either.
dangling_records:
- host: auth.tegus.co
  detail: CNAME to a US Auth0 tenant edge; TLS handshake fails.
- host: help.tegus.co
  detail: CNAME to tegus.helpjuice.com via CloudFront; sslv3 alert handshake failure.
  risk: >-
    A dangling CNAME to a third-party SaaS host is a subdomain-takeover surface if the
    upstream tenant name is ever released.