HSTS Displays Disabled even though the header is present - iis

Question

My company is using Tenable to identify security vulnerabilities. Missing HSTS was identified recently. Our server is using IIS 10.
I've added the HSTS header as outlined in multiple blogs, and questions here on SO.
My root web.config looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appSettings>
<add key="Environment" value="Local" />
</appSettings>
<system.webServer>
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect global" stopProcessing="true" >
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
redirectType="Permanent" />
</rule>
</rules>
<outboundRules>
<rule name="Add Strict-Transport-Security when HTTPS" enabled="true">
<match serverVariable="RESPONSE_Strict_Transport_Security"
pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="max-age=31536000; includeSubDomains; preload" />
</rule>
</outboundRules>
</rewrite>
</system.webServer>
</configuration>
Problem: After the changes have been applied, Tenable is still showing a vulnerability. Further, upon inspecting a site in FireFox's dev tools, I can see the header is present, however the security tab indicates that HSTS is disabled.
Question: How do I make this change show up for Firefox and Tenable?

Answer 1

It could also be related to preload tag, that you mentioned in the HSTS header. Are you certain that your site is already added in the preload list (maintained by google/chrome)
If you are deploying your site as sub-domain, then you may also need to add HSTS to parent domain (which is not a sub-domain) and submit for preload.
Once done you can verify and look for more details at https://hstspreload.org/