Everything DomainDrift does
Continuous, signed telemetry for the domain layer: who runs a domain's DNS, mail, certificates and hosting, what changed today across the whole index, and what changed on the domains you care about. This page is the complete list, with exactly what each lane gets. Amounts live on pricing.
The signed record
Every observation is Ed25519-signed at the moment it is taken, chained to the one before it, and archived. The signature proves attribution and integrity: that we published exactly these bytes, and that nothing changed since. It is added accountability on top of the data, not a claim that the data is correct.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| Live domain preview One curl, no key: who runs the nameservers, mail and CDN, the certificate issuer and expiry, reachability, and per-type record counts. | No account: 1 request / 15s per IP | Free account: The complete record | Paid plan: The complete record | Agents: The complete record |
| The complete signed record Every DNS record, certificate, subdomain and probe result we hold for a domain, with its receipt. | No account: not included | Free account: included in The complete signed record | Paid plan: included in The complete signed record | Agents: included in The complete signed record |
| Time machine A durable, shareable URL for a domain at a point in time. The latest snapshot is public and free. | No account: Latest snapshot | Free account: Full history | Paid plan: Full history | Agents: Full history |
| Receipt verification Resolve any receipt by id and check the signature yourself. Published signing keys, verifiable offline. | No account: included in Receipt verification | Free account: included in Receipt verification | Paid plan: included in Receipt verification | Agents: included in Receipt verification |
| Published signing keys The public keys every receipt is signed with, at a well-known URL, so verification never depends on asking us. | No account: included in Published signing keys | Free account: included in Published signing keys | Paid plan: included in Published signing keys | Agents: included in Published signing keys |
Live views of the whole index
The daily read on what the internet actually did: who moved, who is winning, who is dark. Every view is computed from the same signed observations, so two pages can never tell you different numbers.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| What changed today The day in seven readings: DNS, email and certificate movement, plus who is unreachable, erroring, or blocking scanners. | No account: included in What changed today | Free account: included in What changed today | Paid plan: included in What changed today | Agents: JSON + RSS |
| Provider migrations Who gained and who lost, drawn as flows. Net, not gross: a provider that gained 40 and lost 38 churned, and the page says so. | No account: included in Provider migrations | Free account: included in Provider migrations | Paid plan: included in Provider migrations | Agents: included in Provider migrations |
| Provider concentration Who answers for the internet: standing share per lane, and how few providers it takes to cover half of it. | No account: included in Provider concentration | Free account: included in Provider concentration | Paid plan: included in Provider concentration | Agents: included in Provider concentration |
| Reachability What is not reachable, what answered with an error, and what is blocking our scanner, with the composition behind each. | No account: included in Reachability | Free account: included in Reachability | Paid plan: included in Reachability | Agents: included in Reachability |
| Security posture Certificate expiry, email authentication (SPF, DMARC, DKIM, MTA-STS), DNSSEC and dangling-CNAME exposure across the index. | No account: included in Security posture | Free account: included in Security posture | Paid plan: included in Security posture | Agents: included in Security posture |
| The provider map The index drawn by who runs what, so concentration is something you can see rather than read. | No account: included in The provider map | Free account: included in The provider map | Paid plan: included in The provider map | Agents: included in The provider map |
| Provider leaderboards The standing board per provider: who they serve, and what moved this week. | No account: Top 3 + the true total | Free account: included in Provider leaderboards | Paid plan: included in Provider leaderboards | Agents: included in Provider leaderboards |
| Catalog browsing and search Every tracked domain by category, service, and certificate authority, searchable by name, IP, provider, registrar or ASN. | No account: Top 3 + the true total | Free account: included in Catalog browsing and search | Paid plan: included in Catalog browsing and search | Agents: included in Catalog browsing and search |
| Live change stream Server-sent events: changes, scans and receipts as they happen, plus a JSON fallback. | No account: JSON + RSS feeds | Free account: included in Live change stream | Paid plan: included in Live change stream | Agents: included in Live change stream |
Monitoring your own domains
Put a domain under watch and it is re-checked every 5 minutes: nameservers, mail, certificate, DNSSEC and reachability. The signed history is kept, and anything material reaches you the moment it happens.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| Domain monitoring Your domains on the 5-minute watch lane, with the full signed record kept for each check. | No account: not included | Free account: Your first domain | Paid plan: More domains, every plan raises it | Agents: not included |
| Change alerts Webhooks into Slack, Teams, Discord or anything that takes a POST, signed with an HMAC so you can verify the sender. | No account: not included | Free account: included in Change alerts | Paid plan: Higher subscription caps | Agents: not included |
| Certificate watch Know before a certificate expires, and the moment the issuing authority changes on a domain you own. | No account: not included | Free account: included in Certificate watch | Paid plan: included in Certificate watch | Agents: not included |
| Domain groups Manage and alert on a portfolio as one unit rather than domain by domain. | No account: not included | Free account: not included | Paid plan: included in Domain groups | Agents: not included |
| Approved baselines Sign off a known-good record. From then on, anything that drifts from it is flagged until you approve the new state. | No account: not included | Free account: not included | Paid plan: included in Approved baselines | Agents: not included |
| Status badge An embeddable badge for a domain you monitor, served straight from the signed record. | No account: included in Status badge | Free account: included in Status badge | Paid plan: included in Status badge | Agents: included in Status badge |
Evidence you can hand to someone else
The point of signing is that the record survives leaving us. Exports carry their receipts, so an auditor, a customer or a court can check them without trusting the page they came from, or us.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| Signed evidence bundles A complete, portable record for a domain with every receipt attached, verifiable offline after we are out of the loop. | No account: not included | Free account: included in Signed evidence bundles | Paid plan: included in Signed evidence bundles | Agents: Account keys only |
| Printable evidence report The same record as a report you can print or hand over, formatted for a human reader. | No account: not included | Free account: included in Printable evidence report | Paid plan: included in Printable evidence report | Agents: not included |
| CSV export The same filtered set you are looking at, as a download, for a spreadsheet or a warehouse. | No account: not included | Free account: included in CSV export | Paid plan: included in CSV export | Agents: included in CSV export |
| Offline verification The published verifier and key set, so anyone can check a bundle without an account or a network call to us. | No account: included in Offline verification | Free account: included in Offline verification | Paid plan: included in Offline verification | Agents: included in Offline verification |
Built to be read by machines
The API is the product and the page is a thin window on it. Every surface a person uses is a documented endpoint an agent can call, with the same gates and the same signatures.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| The metered REST API One documented door for everything on this page, with OpenAPI 3.1 and a live playground. | No account: Keyless preview endpoint | Free account: A free key, daily allowance | Paid plan: More volume every day | Agents: included in The metered REST API |
| MCP server Connect an AI assistant directly: the same tools, the same keys, the same pay gate as the API. | No account: not included | Free account: included in MCP server | Paid plan: included in MCP server | Agents: included in MCP server |
| x402 pay-per-call For an agent that would rather settle one request than hold an account: call with no key, get a price, pay on Base, retry. | No account: Settle per request | Free account: not included | Paid plan: not included | Agents: included in x402 pay-per-call |
| Machine-readable discovery llms.txt, OpenAPI, a domain sitemap and well-known key endpoints, so a crawler or agent can find the shape on its own. | No account: included in Machine-readable discovery | Free account: included in Machine-readable discovery | Paid plan: included in Machine-readable discovery | Agents: included in Machine-readable discovery |
| API playground Run a real request against the live API from the browser, before you write any code. | No account: included in API playground | Free account: included in API playground | Paid plan: included in API playground | Agents: included in API playground |
Free tools, no signup
8 single-answer tools for the questions people actually search: one domain in, one clear verdict out. Free, bookmarkable, and no account at any point.
| Capability | No accountno key, no signup | Free accountno card | Paid planamounts on /pricing | AgentsAPI · MCP · x402 |
|---|---|---|---|---|
| WHOIS Lookup Who owns this domain? | No account: included in WHOIS Lookup | Free account: included in WHOIS Lookup | Paid plan: included in WHOIS Lookup | Agents: not included |
| Domain Expiry When does this domain expire? | No account: included in Domain Expiry | Free account: included in Domain Expiry | Paid plan: included in Domain Expiry | Agents: not included |
| DNS Health Check Is this domain’s DNS healthy? | No account: included in DNS Health Check | Free account: included in DNS Health Check | Paid plan: included in DNS Health Check | Agents: not included |
| Email Security Check Can someone fake email from this domain? | No account: included in Email Security Check | Free account: included in Email Security Check | Paid plan: included in Email Security Check | Agents: not included |
| SSL Certificate Check Is this domain’s certificate valid? | No account: included in SSL Certificate Check | Free account: included in SSL Certificate Check | Paid plan: included in SSL Certificate Check | Agents: not included |
| DNSSEC Check Is this domain protected from DNS tampering? | No account: included in DNSSEC Check | Free account: included in DNSSEC Check | Paid plan: included in DNSSEC Check | Agents: not included |
| DNS Propagation Has this domain’s DNS propagated? | No account: included in DNS Propagation | Free account: included in DNS Propagation | Paid plan: included in DNS Propagation | Agents: not included |
| Blacklist Check Is this domain’s IP on a blocklist? | No account: included in Blacklist Check | Free account: included in Blacklist Check | Paid plan: included in Blacklist Check | Agents: not included |
Where this fits
Most teams already run something in this space, and usually should. Here is the honest map of what each kind of tool is for, and what continuous signed telemetry adds next to it.
Your registrar and DNS dashboards
Authoritative for the domains inside that one account, and the place you go to make a change.
One view across every domain you care about no matter who registers or hosts it, a history of what it looked like before, and a signed record of each state.
Uptime and synthetic monitoring
Telling you fast that a site stopped responding, from many locations, with good alerting.
The layer underneath reachability: which nameservers, mail route, certificate authority and registrar the domain is on, and the moment any of them changes.
Certificate transparency search
Finding every certificate ever issued for a name, straight from the public logs.
Certificates joined to the rest of the domain’s infrastructure and watched over time, so an issuer change is an alert with context rather than a log entry to notice.
Passive DNS and threat intelligence feeds
Deep historical resolution data and enrichment for investigation work.
A signed, receipted observation for each reading, and a change feed built around what materially moved rather than raw resolution history.
Attack-surface and asset discovery
Finding the assets you did not know you had, and scoring their exposure.
Continuous, verifiable telemetry on the assets once you know them, with an evidence trail an auditor can check without trusting either of us.
A script you wrote against a resolver
Exactly what you want, on your schedule, for free.
The parts that get expensive: a scanned index at scale, corroboration across independent resolvers before a change is believed, signed history, and alerting you did not have to keep alive.
These are categories of tooling, not products, and the pairing is the point: the fastest setups we see run something from one of the rows above alongside a signed record of what the domain layer underneath is doing.
Start with a curl, not a signup
One request returns a real, current preview of the signed record for any domain. A free account opens the complete record, the full history, and monitoring for your first domain.