CONTINUOUS INTERNET TELEMETRY24H DRIFT10,378 material changesacross 10,005 domainsDNS DRIFT763 domains changed DNS providertop destination parity.domainsEMAIL DRIFT160 domains switched email providertop destination google.comCERT DRIFT221 domains switched issuing CA24hNOW1,378 curated domains not reachable-1,332 vs yesterdaySITE ERRORS19,658 sites serving errorslast probe · 5xx / 404 / TLSTHROTTLED94,668 throttled or blocked our scanner429 rate-limit / 403 bot-block
Docs / Verification

Verification

Every observation DomainDrift records is signed with Ed25519 at the moment of observation. This page explains exactly what that buys you, what it deliberately does not claim, and how to run the checks yourself.

What a receipt is

A receipt is a signed commitment: an id, the action, a timestamp, the hash of the observed data, the signature, the signing key, and a link to the previous receipt for the same domain - a chain. Any receipt resolves publicly at /receipts/<id>, keyless.

What it proves - and what it does not

A valid signature proves attribution (DomainDrift recorded this) and integrity (it has not been altered since). It is added trust on top of the observation: accountability, permanence, non-repudiation. It is not a claim that the observation itself is infallible - no signature can make a reading correct. That is why the product also shows you its work: observation timestamps on every plane, dual-resolver confirmation on the highest-weight changes, and live probes you can run from your own browser to corroborate a reading from your own network.

Checking a receipt yourself

  1. Fetch the record and its receipt chain: GET /v1/domains/:domain and GET /v1/domains/:domain/provenance.
  2. Hash the signed data and compare it to the receipt's output hash.
  3. Verify the Ed25519 signature against the published keys at /.well-known/domaindrift-keys.json.
# the receipt chain for a domain
curl -H "X-DomainDrift-Key: dd_..." https://domaindrift.io/v1/domains/example.com/provenance
# any single receipt, keyless
curl https://domaindrift.io/receipts/RECEIPT_ID
# the signing keys
curl https://domaindrift.io/.well-known/domaindrift-keys.json

Or skip the terminal: paste a bundle into the verifier and every check runs in your own browser - the page never asks you to take its word for the result.

The verifier is honest about coverage

Signature validity and data binding are reported as separate checks, in three states: data-bound (the archived bytes hash to the receipt), binding not applicable (an older receipt predates byte archiving, so that one optional check cannot be run - reported neutrally, never as a failure), and failed (archived bytes that do not match - the state that must scream). Exports report their own coverage the same way, so an auditor is never instructed to run a check that cannot pass.

Carrying the evidence elsewhere

  • Evidence report - GET /v1/evidence/:domain: a printable, signed report for audits and disputes.
  • Signed bundle - GET /v1/domains/:domain/bundle: the offline-verifiable export; hand it to anyone and they can verify it without talking to DomainDrift at all.
  • Badge - /badge/<domain>.svg: an embeddable live status badge.
  • Point-in-time pages - /t/<domain> (latest, free) and /t/<domain>/<timestamp> (historical, signed in) are durable, shareable URLs for a specific signed snapshot.
← Connect an agent (MCP)Plans & limits →