property.nhs.uk

HTML metadata

Title: NHS Property Services | Home
Description: NHS Property Services provides strategic estates services to enable excellent patient care. As part of the NHS, we help Integrated Care Boards, Trusts and GP practices to better assess, adapt and manage around 3,000 buildings – safely and sustainably
Language: en

Open Graph

url: https://www.property.nhs.uk/
title: NHS Property Services | Home
description: NHS Property Services provides strategic estates services to enable excellent patient care. As part of the NHS, we help Integrated Care Boards, Trusts and GP practices to better assess, adapt and manage around 3,000 buildings – safely and sustainably

Technology

Server: Microsoft-IIS

Analytics

Google Tag Manager

Cookie consent

Cookiebot

Third-party hosts loaded (6)

cdn.jsdelivr.net×1
code.jquery.com×1
consent.cookiebot.com×1
extend.vimeocdn.com×1
maps.googleapis.com×1
www.googletagmanager.com×1

Social

DNS records live

NS

ns1.nhs.uk
ns2.nhs.uk
ns3.nhs.uk
ns4.nhs.uk

MX

0 property-nhs-uk.mail.protection.outlook.com

TXT

Show 10 TXT records

ehkccefj82unu0jthvp96d8j2d
k51kcf1qgm7hta9hj6d3r9tdud
00D0O000000rwim=1TBPz00000001q1
4jxbx4810gkt4xgwtttz08mq0qjbd895
80z31tz0c4nvbjncm8vfh1mmbb8zcy6t
msfpkey=2ddh8ie9uzgvoambv6h8r5wr1
asv=4a34fd87fc7663208cd3320bf5fa61d4
d365mktkey=3ou078doq1w1l11u6o7vi074j
domain.zoho.com.
e10h33g5hd6nq2j422brs9ad6c

Email authentication strong

SPF

v=spf1 include:spf.protection.outlook.com ip4:13.79.32.236 ip4:52.169.161.176 ip4:213.143.153.2 ip4:5.61.115.80/28 ip4:80.6.91.150 ip4:37.244.88.0/24 ip4:85.133.123.0/24 include:mailgun.org ~all

softfail (~all)

DMARC

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-rua@dmarc.service.gov.uk,mailto:cybersecurity@property.nhs.uk,mailto:dmarc_agg@vali.email; ruf=mailto:cybersecurity@property.nhs.uk

policy: quarantine

DKIM

Show 4 DKIM selectors

selector1: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApjqN7G2GVNk812/A0mrxYK9Q2mYu9iST5LmecjBZg7TgK12a1Bh/GZSDzn6tYjGfpET8lP4cFuouLv…
selector2: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAo37MX5DPpBaGpPrx3nt31VdIPZ40XsLiAzAQ2Tirb0osshzAulINHsli3a5d8yZKriUIvPQPd69i1J…
s1: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsmbMJqYIDNgSwPXPr6ViG81qfL84VOUzLLWRVypl1TpTNTnc33qoJZBWyMzYoj7eE0S04GpE6hCN2/IZOb…
s2: k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz9uNoVX3mpkSg4RgV+4NmFrT6n64XqP+56YkbCTJG5p9+O5McRoVkfTdVTSi7mISgFWmiKrH034wNOi66T…

selectors probed

Certificate (current)

WR3

from 2026-03-18 to 2026-06-16

Expires in 28 days

Full certificate history on crt.sh ↗

HTTP security headers

Header hygiene 80/100 Checked live page: https://www.property.nhs.uk/

present

strict-transport-security
content-security-policy
x-frame-options
x-content-type-options

findings

CSP allows unsafe inline scripts/styles
CSP uses wildcard sources
missing Referrer Policy
missing Permissions Policy

Header values

x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' *.cookiebot.com *.jquery.com *.property.nhs.uk *.nhs.uk *.microsoft.com *.dynamics.com *.reciteme.com *.cloudflare.com *.visualwebsiteoptimizer.com *.vimeocdn.com *.fonts.net *.azureedge.net *.licdn.com *.hotjar.com *.sharethis.com *.clarity.ms *.googleoptimize.com *.aspnetcdn.com *.facebook.net *.typekit.net *.datadoghq-browser-agent.com *.ggpht.com cdn.jsdelivr.net *.vimeo.com *.umbraco.com *.youtube.com *.google.co.uk *.google.com *.googletagmanager.com *.google-analytics.com *.googlesyndication.com *.googleadservices.com *.gstatic.com *.googleapis.com *.bing.com *.facebook.com *.facebook.net *.twitter.com *.linkedin.com data: wss: blob:;
strict-transport-security: max-age=31536000; includeSubDomains;