# DomainDrift - Internet Telemetry Index
# https://domaindrift.io

DomainDrift maintains a catalog of ~1,006,000 domains and re-scans 214,000 of them every day, sweeping the whole catalog in under 5 days. It records DNS records, TLS certificates, WHOIS data, HTTP probes, email authentication and DNSSEC. Every observation is Ed25519-signed with provenance receipts, and there are 7.1 million of them on record.

## Try it with no key

GET /v1/domains/:domain - a PREVIEW of the latest signed snapshot for ONE domain, no API
key required.

    curl https://domaindrift.io/v1/domains/example.com

The keyless response is a real, current preview, not the full record. It carries the derived
facts: who runs the nameservers, mail and CDN; the certificate issuer and expiry date; whether
the site is reachable; when it was scanned; the snapshot id; and per-type RECORD COUNTS. It also
carries a pointer to the Ed25519 receipt (id + the full record's output_hash + a public
/receipts/:id URL you can resolve with no key) so you can see the signed commitment exists.

The preview is NOT signed, deliberately: a signature commits to the exact bytes of the FULL
record, so one attached to a reduced subset could never verify. Withheld keyless: the DNS record
VALUES (A/AAAA/MX/NS/TXT/CNAME/SOA/CAA/SRV), certificates, subdomains, WHOIS, probe headers,
history, the provenance chain, and every bulk surface.

Limits: 1 request per 15 seconds per IP, under a shared global daily ceiling. Every response
carries X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset.

An API key is free and returns the COMPLETE signed record on the same URL, and the receipt above
verifies against it. Lists, history, bulk, and exports require a key.

## API (X-DomainDrift-Key header)

GET /health - Service health (public, no auth)
GET /v1/domains - Paginated domain list
GET /v1/domains/:domain - Latest signal snapshot (keyless: a reduced preview; keyed: full)
GET /v1/domains/:domain/history - Time-series snapshots
GET /v1/domains/:domain/provenance - Receipt chain
GET /v1/changes - Global change feed
GET /v1/stream - SSE event stream

## MCP

POST https://domaindrift.io/mcp - a read-only MCP server (streamable HTTP, stateless). Five
tools: lookup_domain, whats_changed_today, resolve_receipt, internet_tape, signing_keys.
Descriptor: https://domaindrift.io/.well-known/mcp.json
Who advertises MCP in DNS (our own scan data): https://domaindrift.io/mcp-adoption
Every tool is a name for an existing HTTP route and is served through the SAME access lanes:
keyless tool calls get the reduced preview under the same per-IP throttle and shared daily
ceiling; send a DomainDrift API key as an Authorization: Bearer header to open the complete
record on your metered allowance.

## Who it is for

One page per buyer, each mapping live features onto that job:

- https://domaindrift.io/for/domain-investors - portfolio watch, nameserver/registrar/status alerts, expiry ladder, signed sale/dispute evidence
- https://domaindrift.io/for/webmasters - DNS + certificate + registration + reachability in one watch, before/after change alerts
- https://domaindrift.io/for/sales-teams - infrastructure change events (hosting, mail, CDN, certs) as timestamped sales triggers, by API
- https://domaindrift.io/for/compliance - continuous vendor monitoring, signed posture-on-a-date evidence, browser verifier
- https://domaindrift.io/for/security-teams - bring-your-own watchlists (incl. typosquat candidate lists), per-plane signed drift events
- https://domaindrift.io/for/business-owners - hijack + expiry + email-record monitoring in plain language, signed evidence

## Access

Product documentation (every feature + the API, explained): https://domaindrift.io/docs
API console + the free/metered board: https://domaindrift.io/api
Sign in with your DRM3 account at https://drm3.network/account (DomainDrift is enabled from the app catalog). Programmatic access uses an X-DomainDrift-Key (dd_) API key.

## Related

- Status: https://status.drm3.network
- Products: https://status.drm3.network/products.json
- Signing keys: https://domaindrift.io/.well-known/domaindrift-keys.json

DRM3 is a data infrastructure company. https://drm3.io