Monitoring & alerts
Watching is the working half of DomainDrift: put the domains you are responsible for under watch, and the product re-checks them every 5 minutes, keeps the signed history, and tells you the moment something material moves - in the channel your team actually reads.
Watching a domain
A watched domain has its nameservers, mail, certificate, DNSSEC, and reachability re-checked every 5 minutes. Every check lands in the signed history, and material changes become alert events. Set it up at Alerts: subscribe to a single domain, to a group, or to the whole catalog.
Groups
A group is a set of watched domains you manage and alert on as one - a client portfolio, a brand family, an estate. Bring your own domains, organize them into groups, and point alert subscriptions at the group instead of each name. Manage them at Domain groups.
Approved baselines
An approved baseline is the known-good record you sign off for a domain. From then on, anything that drifts from the baseline is flagged until you approve the new state. It turns monitoring from "tell me what changed" into "tell me what changed that I did not approve" - the difference that matters during a migration, an agency handoff, or an incident.
Material change, not noise
Every detected change is scored. Routine churn - a TTL bump, a rotating cloud IP - stays quiet; structural moves rank at the top of the wire: authoritative DNS or mail moves, certificate issuer changes, registrar transfers, reachability transitions, posture regressions. Alerts fire on material changes only, so an alert from DomainDrift means something actually moved.
Alert channels
- Webhook - a POST to your endpoint with the structured change event.
- Email - to a verified address: the subscription stays inactive until the recipient clicks the confirmation link, so nobody can aim alerts at an inbox they do not control.
- Slack, Teams, Discord - point the subscription at an incoming-webhook URL and the alert lands in the room, formatted for it.
Webhook contract
Every webhook delivery is signed and self-describing:
| Header | Meaning |
|---|---|
X-DomainDrift-Signature | sha256= + HMAC-SHA256 of the exact body, keyed with your subscription secret (shown once at create). Recompute and compare before trusting a delivery. |
X-DomainDrift-Event | The event type, so a receiver can route without parsing the body. |
Failed deliveries are retried three times with growing backoff before the subscription's delivery is marked dead, so a receiver that was briefly down does not silently miss a change.
The same, over the API
Everything above is also programmable: GET/POST/DELETE /v1/alerts manages subscriptions, GET /v1/groups your groups. See The API.