Evidence bundle

The export you hand to someone who has to check your work.

A DomainDrift evidence bundle is a single, self-contained JSON export of one domain's signed record: the observations, the Ed25519 receipts that commit to them, and the public keys they verify against. It is built to be verified by a third party, offline, with no DomainDrift account and no call back to us. A dispute, an audit, or a compliance review can independently confirm who recorded each observation, when, and that nothing has been altered since it was signed.

Who reaches for one

Registrar & UDRP disputes

Show what a domain's DNS, certificate, and registration looked like on a given day, with a signature that says it was not edited after the fact.

Security & posture audits

Hand an auditor the signed reachability, TLS, DNSSEC, and email-auth planes instead of a screenshot they have to take on faith.

Compliance reviews

A portable, timestamped record with an attribution chain, suitable to attach to a report that someone else signs off on.

Vendor & M&A diligence

Capture a counterparty's public infrastructure state at the moment of review, in a form the other side can re-check themselves.

What is inside

The domain's signed observations across planes: DNS, certificate, reachability, registration, ASN, DNSSEC, robots, and derived posture, exactly as recorded.
The Ed25519 receipt for each observation: the commitment hash, the signing key, the timestamp, the chain link to the previous scan, and the exact signed bytes where they were archived.
The signing keys and where to check them independently (/.well-known/domaindrift-keys.json).
An honest coverage report: how many receipts carry their re-verifiable payload and how many predate payload archiving, stated plainly rather than instructing a check that cannot pass.

Each bundle captures the domain's observations from the last 24 hours. Earlier observations remain in the signed archive and are retrievable one at a time from the time machine.

What the export looks like

{
  "format": "connor.signed-bundle.v1",
  "generated_at": "2026-07-23T14:22:07Z",
  "domain": "example.com",
  "tracked_since": "2026-04-14T00:00:00Z",
  "summary": { "observations": 6, "planes": ["asn","dnssec","fast","robots","whois"], "window_hours": 24 },
  "observations": [
    {
      "plane": "fast",
      "observed_at": "2026-07-23T13:55:01Z",
      "output_hash": "b6c1f0…",
      "public_key": "CMtQdO…",
      "signature": "3a91e4…",
      "parent_receipt_id": "…",
      "signed_outputs": "{ the exact bytes the signature commits to }"
    }
  ],
  "public_keys": [
    { "identifier": "CMtQdO…", "algorithm": "Ed25519",
      "published_at": "https://domaindrift.io/.well-known/domaindrift-keys.json" }
  ],
  "verification": {
    "protocol": "drm3-provenance-v1",
    "sdk": "npm: @drm3/sdk",
    "proves": "attribution + integrity",
    "coverage": { "signed_outputs_present": 6, "signed_outputs_absent": 0 }
  },
  "verifier_url": "https://domaindrift.io/verify"
}

What a signature does and does not prove

A signature proves attribution and integrity: DomainDrift observed this, at this time, and the record has not been altered since. It is added trust, not a claim of correctness. DomainDrift puts its name on every observation, permanently and non-repudiably, and cannot alter or walk it back. The bundle makes that accountability portable.

How a third party verifies it

# pull the bundle - a keyed API export (Pro plans and up)
curl -H "X-DomainDrift-Key: dd_..." \
  https://domaindrift.io/v1/domains/example.com/bundle > evidence.json

# the RECIPIENT needs no key and no account: verify offline against the
# published keys with @drm3/sdk, or paste any receipt id at domaindrift.io/verify

Who it is on

Evidence bundles are included on Pro plans and up. They are deliberately not sold per-call and not part of the free tier: an export that carries your dispute or your audit rides an account we can stand behind. Free accounts keep the complete signed record on screen, the receipt resolver, and the verifier.

See plans → Try the verifier → Read the spec →