Evidence bundle

The export you hand to someone who has to check your work.

A DomainDrift evidence bundle is a single, self-contained JSON export of one domain's signed record: the observations, the Ed25519 receipts that commit to them, and the public keys they verify against. It is built to be verified by a third party, offline, with no DomainDrift account and no call back to us. A dispute, an audit, or a compliance review can independently confirm who recorded each observation, when, and that nothing has been altered since it was signed.

Who reaches for one

Registrar & UDRP disputes

Show what a domain's DNS, certificate, and registration looked like on a given day, with a signature that says it was not edited after the fact.

Security & posture audits

Hand an auditor the signed reachability, TLS, DNSSEC, and email-auth planes instead of a screenshot they have to take on faith.

Compliance reviews

A portable, timestamped record with an attribution chain, suitable to attach to a report that someone else signs off on.

Vendor & M&A diligence

Capture a counterparty's public infrastructure state at the moment of review, in a form the other side can re-check themselves.

The artifact, on screen

A signed infrastructure evidence report for one domain: a dated summary, observation counts, and DMARC posture, with a print / save-as-PDF button. — The signed evidence report for one domain: a dated summary (61 observations, 304 scans) and the security posture (DMARC `p=reject`, PASS), each line from an Ed25519-signed observation, with a print / save-as-PDF button.

A domain page stating every observation on it is Ed25519-signed, with verify-this-page, download-short-proof, and download-full-bundle buttons. — The domain page every bundle is drawn from: every observation on it is Ed25519-signed, with verify-this-page, download-short-proof, and download-full-bundle right there.

What is inside

The domain's signed observations across planes: DNS, certificate, reachability, registration, ASN, DNSSEC, robots, and derived posture, exactly as recorded.
The Ed25519 receipt for each observation: the commitment hash, the signing key, the timestamp, the chain link to the previous scan, and the exact signed bytes where they were archived.
The signing keys and where to check them independently (/.well-known/domaindrift-keys.json).
A coverage report: how many receipts carry their re-verifiable payload and how many predate payload archiving, stated plainly rather than instructing a check that cannot pass.

Two depths, and the deep one is bought, not included

There are two exports, and they differ only in how far back they reach. The 7-day export is the included artifact: Pro carries an allowance of them each month. The 90-day export is the one an audit or a dispute usually wants, and it is a la carte on every plan - it is not a tier perk at any price, because a buyer wants a deep evidence bundle on the day they need it and then wants exactly one.

Buying one is explicit. Ask for the deep window without saying you will pay and the API answers with a quote naming the price and the exact URL that repeats the request with your consent, and nothing is charged. The current prices are on the solutions page, read from the same catalog that bills them.

Nothing outside the window was thrown away. Each export states the window it covers on the artifact itself, so an auditor never has to infer it, and older observations stay on the permanent record, retrievable one at a time from the time machine.

What the export looks like

{
  "format": "connor.signed-bundle.v1",
  "generated_at": "2026-07-23T14:22:07Z",
  "domain": "example.com",
  "tracked_since": "2026-04-14T00:00:00Z",
  "summary": { "observations": 6, "planes": ["asn","dnssec","fast","robots","whois"],
               "window_days": 90, "window_truncated": false,
               "window_note": "This export covers the last 90 days: every signed observation …" },
  "observations": [
    {
      "plane": "fast",
      "observed_at": "2026-07-23T13:55:01Z",
      "output_hash": "b6c1f0…",
      "public_key": "CMtQdO…",
      "signature": "3a91e4…",
      "parent_receipt_id": "…",
      "signed_outputs": "{ the exact bytes the signature commits to }"
    }
  ],
  "public_keys": [
    { "identifier": "CMtQdO…", "algorithm": "Ed25519",
      "published_at": "https://domaindrift.io/.well-known/domaindrift-keys.json" }
  ],
  "verification": {
    "protocol": "drm3-provenance-v1",
    "sdk": "npm: @drm3/sdk",
    "proves": "attribution + integrity",
    "coverage": { "signed_outputs_present": 6, "signed_outputs_absent": 0 }
  },
  "verifier_url": "https://domaindrift.io/verify"
}

What a signature does and does not prove

A signature proves attribution and integrity: DomainDrift observed this, at this time, and the record has not been altered since. It is added trust, not a claim of correctness. DomainDrift puts its name on every observation, permanently and non-repudiably, and cannot alter or walk it back. The bundle makes that accountability portable.

How a third party verifies it

# pull the bundle - a keyed API export (any paid plan)
curl -H "X-DomainDrift-Key: dd_..." \
  https://domaindrift.io/v1/domains/example.com/bundle > evidence.json

# the RECIPIENT needs no key and no account: verify offline against the
# published keys with @drm3/sdk, or paste any receipt id at domaindrift.io/verify

Who it is on

The included 7-day export comes with Pro plans and up, as a monthly allowance. The 90-day export is bought per export on any paid plan. Neither is on the registered tier: an export that carries your dispute or your audit rides an account we can stand behind. Registered accounts keep the complete signed record on screen, the receipt resolver, and the verifier.

What it's for → Try the verifier → Read the spec →