The export you hand to someone who has to check your work.
A DomainDrift evidence bundle is a single, self-contained JSON export of one domain's signed record: the observations, the Ed25519 receipts that commit to them, and the public keys they verify against. It is built to be verified by a third party, offline, with no DomainDrift account and no call back to us. A dispute, an audit, or a compliance review can independently confirm who recorded each observation, when, and that nothing has been altered since it was signed.
Who reaches for one
Registrar & UDRP disputes
Show what a domain's DNS, certificate, and registration looked like on a given day, with a signature that says it was not edited after the fact.
Security & posture audits
Hand an auditor the signed reachability, TLS, DNSSEC, and email-auth planes instead of a screenshot they have to take on faith.
Compliance reviews
A portable, timestamped record with an attribution chain, suitable to attach to a report that someone else signs off on.
Vendor & M&A diligence
Capture a counterparty's public infrastructure state at the moment of review, in a form the other side can re-check themselves.
The artifact, on screen
p=reject, PASS), each line from an Ed25519-signed observation, with a print / save-as-PDF button.
What is inside
- The domain's signed observations across planes: DNS, certificate, reachability, registration, ASN, DNSSEC, robots, and derived posture, exactly as recorded.
- The Ed25519 receipt for each observation: the commitment hash, the signing key, the timestamp, the chain link to the previous scan, and the exact signed bytes where they were archived.
- The signing keys and where to check them independently (
/.well-known/domaindrift-keys.json). - An honest coverage report: how many receipts carry their re-verifiable payload and how many predate payload archiving, stated plainly rather than instructing a check that cannot pass.
Each bundle captures the domain's observations from the last 24 hours. Earlier observations remain in the signed archive and are retrievable one at a time from the time machine.
What the export looks like
{
"format": "connor.signed-bundle.v1",
"generated_at": "2026-07-23T14:22:07Z",
"domain": "example.com",
"tracked_since": "2026-04-14T00:00:00Z",
"summary": { "observations": 6, "planes": ["asn","dnssec","fast","robots","whois"], "window_hours": 24 },
"observations": [
{
"plane": "fast",
"observed_at": "2026-07-23T13:55:01Z",
"output_hash": "b6c1f0…",
"public_key": "CMtQdO…",
"signature": "3a91e4…",
"parent_receipt_id": "…",
"signed_outputs": "{ the exact bytes the signature commits to }"
}
],
"public_keys": [
{ "identifier": "CMtQdO…", "algorithm": "Ed25519",
"published_at": "https://domaindrift.io/.well-known/domaindrift-keys.json" }
],
"verification": {
"protocol": "drm3-provenance-v1",
"sdk": "npm: @drm3/sdk",
"proves": "attribution + integrity",
"coverage": { "signed_outputs_present": 6, "signed_outputs_absent": 0 }
},
"verifier_url": "https://domaindrift.io/verify"
}What a signature does and does not prove
A signature proves attribution and integrity: DomainDrift observed this, at this time, and the record has not been altered since. It is added trust, not a claim of correctness. DomainDrift puts its name on every observation, permanently and non-repudiably, and cannot alter or walk it back. The bundle makes that accountability portable.
How a third party verifies it
# pull the bundle - a keyed API export (Pro plans and up)
curl -H "X-DomainDrift-Key: dd_..." \
https://domaindrift.io/v1/domains/example.com/bundle > evidence.json
# the RECIPIENT needs no key and no account: verify offline against the
# published keys with @drm3/sdk, or paste any receipt id at domaindrift.io/verifyWho it is on
Evidence bundles are included on Pro plans and up. They are deliberately not sold per-call and not part of the free tier: an export that carries your dispute or your audit rides an account we can stand behind. Free accounts keep the complete signed record on screen, the receipt resolver, and the verifier.