The signed record
For every domain it tracks, DomainDrift maintains one evolving record: the full public surface, observed repeatedly, diffed against itself, and signed at every observation. This page walks through what is in it and how each piece is collected.
DNS
Nine record types are resolved on every scan: A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, and SRV. DomainDrift also checks for an _mcp._tcp TXT record, so the record notes when a domain advertises MCP for AI service discovery.
Moves of authoritative DNS or mail are the highest-weight changes on the wire, so they are held to a higher standard: before DomainDrift believes an NS or MX change, it confirms the reading against a second, independent resolver. If the two disagree, the change is not recorded and no alert is born. An empty answer is treated as an observation gap, never as "the records were removed".
Reachability
Every scan probes the site over HTTPS and classifies the outcome. There are no silent failures - every probe ends in one of these verdicts:
| Verdict | Meaning |
|---|---|
ok | 2xx - up and healthy |
redirect | 3xx - responds, redirecting |
bot_blocked | 403 from a WAF or bot protection layer |
timeout | No response within the probe window |
tls_error | TLS handshake failed |
connection_refused | TCP port closed or firewalled |
server_error | 5xx - origin down or in maintenance |
not_found | 404 - resolves, but nothing at the root |
rate_limited | 429 - the probe was rate limited |
cf_blocked | Blocked by an edge-network restriction |
network_error | Connection reset or other network failure |
dns_failed | DNS resolution returned no records |
The corpus-wide composition of these verdicts is a public page: Reachability.
Certificates and subdomains
TLS certificates are collected with their issuer, subject, validity window, and SAN names; certificate-transparency logs feed both the certificate history and subdomain discovery (every SAN name a CA ever logged for the domain is a subdomain lead). Issuer changes and approaching expiries surface in the views and in alerts.
Registration
WHOIS and RDAP supply the registrar, creation and expiration dates, and registrant organization and country where the registry publishes them. Registrar moves and expiry windows are first-class change events.
Security posture
From the raw record, DomainDrift derives a posture reading per domain:
- Certificate - issuer, days to expiry.
- Email authentication - SPF, DMARC, DKIM, and MTA-STS presence read from the DNS record itself.
- DNSSEC - whether the chain validates.
- Dangling records - CNAMEs pointing at targets that no longer answer, the classic takeover surface.
The sector-level rollup is public at Security posture.
Network and operators
Resolved addresses are mapped to their announcing network (ASN and operator organization, with country), and the record's values are fingerprinted against a provider catalog: who runs the nameservers, who handles mail, which CDN fronts the site, who issued the certificate. That is what powers Who runs it, Migrations, and the services and certificates views.
Robots and AI crawlers
Each domain's robots.txt is read and classified: whether one exists, whether the site is indexable, and which AI crawlers are explicitly blocked - an increasingly load-bearing corner of the public surface.
Cadence, honestly
Watched domains are re-checked every 5 minutes. The wider corpus is scanned in continuous waves, with registration, DNSSEC, robots, and network data refreshed on their own cycles. Every record carries its observation timestamps, so you always see exactly how fresh each plane is - the record never pretends to be newer than it is.
Signed, at the moment of observation
Every observation is signed with Ed25519 as it is recorded, and each receipt links to the previous one, forming a per-domain chain. Change events reference the receipts on both sides of the change. What that buys you, and how to check it: Verification.