CONTINUOUS INTERNET TELEMETRY24H DRIFT746 material changesacross 258 domains · last 24h · -61 vs yesterdayDNS DRIFT2 domains changed DNS providertop destination domaincontrol.comNOW464 curated domains not reachable+42 vs yesterdaySITE ERRORS17,643 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 100,854 sites429 rate-limit / 403 bot-block, a posture signal
Docs / Verification

Verification

Every observation DomainDrift records is signed with Ed25519 at the moment of observation. This page explains exactly what that buys you, what it deliberately does not claim, and how to run the checks yourself.

What a receipt is

A receipt is a signed commitment: an id, the action, a timestamp, the hash of the observed data, the signature, the signing key, and a link to the previous receipt for the same domain - a chain. Any receipt resolves publicly at /receipts/<id>, keyless.

What it proves - and what it does not

A valid signature proves attribution (DomainDrift recorded this) and integrity (it has not been altered since). It is added trust on top of the observation: accountability, permanence, non-repudiation. It is not a claim that the observation itself is infallible - no signature can make a reading correct. That is why the product also shows you its work: observation timestamps on every plane, dual-resolver confirmation on the highest-weight changes, and live probes you can run from your own browser to corroborate a reading from your own network.

Checking a receipt yourself

  1. Fetch the record and its receipt chain: GET /v1/domains/:domain and GET /v1/domains/:domain/provenance.
  2. Hash the signed data and compare it to the receipt's output hash.
  3. Verify the Ed25519 signature against the published keys at /.well-known/domaindrift-keys.json.
# the receipt chain for a domain
curl -H "X-DomainDrift-Key: dd_..." https://domaindrift.io/v1/domains/example.com/provenance
# any single receipt, keyless
curl https://domaindrift.io/receipts/RECEIPT_ID
# the signing keys
curl https://domaindrift.io/.well-known/domaindrift-keys.json

Or skip the terminal: paste a bundle into the verifier and every check runs in your own browser - the page never asks you to take its word for the result.

The verifier is honest about coverage

Signature validity and data binding are reported as separate checks, in three states: data-bound (the archived bytes hash to the receipt), binding not applicable (an older receipt predates byte archiving, so that one optional check cannot be run - reported neutrally, never as a failure), and failed (archived bytes that do not match - the state that must scream). Exports report their own coverage the same way, so an auditor is never instructed to run a check that cannot pass.

Carrying the evidence elsewhere

  • Evidence report - GET /v1/evidence/:domain: a printable, signed report for audits and disputes.
  • Signed bundle - GET /v1/domains/:domain/bundle: the offline-verifiable export; hand it to anyone and they can verify it without talking to DomainDrift at all.
  • Badge - /badge/<domain>.svg: an embeddable live status badge.
  • Point-in-time pages - /t/<domain> (latest, free) and /t/<domain>/<timestamp> (historical, signed in) are durable, shareable URLs for a specific signed snapshot.
← Connect an agent (MCP)Plans & limits →