Swamp

CAA records are resolved by climbing the DNS tree from the queried name until a CAA resource record set is found, so the policy that governs swampai.world is whatever is published at swampai.world, or failing that at the parent world, and not what is published at www.swampai.world. www carries CAA naming four authorities (globalsign.com, letsencrypt.org, sectigo.com, pki.goog). The apex carries none, and neither does the parent, so for the apex the effective policy is that every publicly trusted certificate authority is free to issue. That matters because the apex is not a dormant name: it answers TLS itself with a certificate whose only subject alternative name is swampai.world, and it redirects to www over HTTPS. The operator plainly intends to restrict who may issue, since they published that intent on www, but the restriction does not reach the name a user types. With HSTS at max-age=63072000 on the apex, the protocol downgrade path is closed, which leaves a mis-issued certificate as one of the few remaining ways to intercept traffic that browsers would accept. CAA does not stop mis-issuance on its own, it narrows the set of authorities who could cause it to a set the operator names.

There is no DMARC record at _dmarc.swampai.world (SPF exists, but SPF alone does not tell a receiver what to do when it fails). Without it, a forged message from swampai.world is delivered on the same footing as a real one, which is the precondition for phishing that appears to come from this domain.

swampai.world serves no /.well-known/security.txt and no /security.txt (both HTTP 404), so there is no machine-readable vulnerability reporting channel despite the declared security contact.

www.swampai.world sets HSTS but omits CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, so the browser has no defence-in-depth against XSS, MIME sniffing and clickjacking.

There is no DMARC record at _dmarc.swampai.world (SPF exists, but SPF alone does not tell a receiver what to do when it fails). Without it, a forged message from swampai.world is delivered on the same footing as a real one, which is the precondition for phishing that appears to come from this domain.