Every website runs on
things you can't see.
Who hosts it. Who handles its mail. Who issues its certificate. Whether it is up. DomainDrift reads the whole surface of ~50,000 sites, records how each one moves, and cryptographically signs every observation the moment it is made. Check any of it yourself. Type a company you know and look inside.
Then watch it, and keep the receipt.
Put a domain on watch and DomainDrift re-checks it every five minutes — nameservers, mail records, certificate, DNSSEC, whether it answers at all. When something material moves, the alert lands in Slack, Teams, Discord, a webhook, or your inbox, scored so routine churn stays quiet.
Every observation behind that alert is Ed25519-signed at the moment it is made. Export the evidence bundle and anyone you hand it to — an auditor, an underwriter, opposing counsel — can confirm for themselves that it came from DomainDrift and has not been altered since. A signature is not a promise that we are right; it is a permanent, checkable record of exactly what we saw and when.
And because DomainDrift watches ~50,000 domains at once, it can tell you the thing a tool pointed only at your zone never can: when the problem is not you.
The whole surface
Who hosts it, who handles its mail, who issues its certificate, whether it is up and why. Nine DNS record types, TLS from CT logs, WHOIS, subdomains, DNSSEC, ASN, robots.txt, plus certificate-expiry and SPF/DMARC/DKIM posture and a dangling-delegation flag, across ~50K curated domains.
And how it moves
Every change scored and timestamped: a nameserver shift, a certificate expiry, a mail migration. Read the signed record as a daily feed or RSS/JSON, or wire a signed webhook and get the material ones the moment DomainDrift confirms them.
On a record you can prove
Every observation is Ed25519-signed the moment it is made, and the exact signed bytes are kept so you can re-check the receipt against the data yourself. Pull a signed evidence bundle for an auditor, an underwriter, or a court and verify it offline against DomainDrift's published keys. DomainDrift puts its name on every line, permanently.
Built for agents
REST, an SSE feed, and an OpenAPI spec. Sign in for a free key, or pay per call over x402 in USDC on Base. The same public, metered door for everyone. No backstage keys.
- One domain, no key:
curlthe API in 5 seconds - The daily "what changed" feed + RSS
- Any domain's signed snapshot on the Time Machine
- The top 3 of every list, with the full count shown
- Keyless API: 1 request / 15s per IP · a preview record
- The complete signed record, not the preview
- Every list in full, not the top 3
- Domain detail pages + point-in-time history
- Signed webhook alerts on change
- 1,000 API requests a month · 34 a day
- Burst: pull 3x your daily share when you need it
- Bulk export + CSV + signed evidence bundles
- Custom domain cohorts & tags
- Faster scan cadence · MCP access
Anonymous is a real slice of the product, not a screenshot: live data, signed, rate limited. Registered is free and opens the whole wire plus your own read key. The free daily cap is the monthly allowance spread evenly across the month, so free requests cannot be batched into a bulk pull - burst is what a paid plan buys. Every price on this page is read from the offer catalog at load, and every limit from the live meter: DomainDrift does not print a number it cannot sell or does not enforce.