Spotlight

GitHub, under continuous watch.

If GitHub's nameservers moved tonight, every CI pipeline on earth would follow the new records without asking. DomainDrift reads this estate about every 5 minutes and signs each reading - here is the live record.

The briefing2026-09-04

Domaindrift.io scanned five GitHub domains on September 4, 2026. The estate held steady with zero material changes across the window. github.com runs on Cloudflare and uses Microsoft 365 for mail. Its registration expires in 35 days. githubassets.com and githubusercontent.com also use Cloudflare. They have no published mail servers. github.io and githubstatus.com run on GitHub Pages. Both answer web requests.

All records remain signed and verified by the service. No new certificates or registrations appeared. The web answers vary by domain but are present where checked. Registration times range from 35 to 520 days. The estate held steady because no changes occurred. This covers the current state without extra data. The scan confirms the existing configuration matches the signed records.

The estate

github.comUp right now

The front door. Web, API, and git-over-HTTPS.

Runs onCloudflare

Email byMicrosoft 365

Also usesAWS Route 53ServalMiroOpenAILoomSendGrid

Registration 34dRead 23:46 UTCSigned record →

githubusercontent.comNo web page - DNS only

Raw file delivery. Every raw fetch rides its DNS.

Runs onCloudflare

Also usesAWS Route 53GlobalSignCloudflare (proxied)

Registration 519dRead 23:45 UTCSigned record →

github.ioUp right now

GitHub Pages. Millions of project sites.

Runs onGitHub Pages

Also usesAWS Route 53CloudflareCloudflare (proxied)

Registration 184dRead 23:45 UTCSigned record →

githubassets.comNo web page - DNS only

Static assets for github.com itself.

Runs onCloudflare

Also usesAWS Route 53Cloudflare (proxied)

Registration 49dRead 23:44 UTCSigned record →

githubstatus.comUp right now

The status page people check when the rest misbehaves.

Runs onGitHub Pages

Also usesAWS Route 53Atlassian StatuspageGoogle Search ConsoleAtlassianCloudflareCloudflare (proxied)

Registration 216dRead 23:44 UTCSigned record →

Recent movement

No material movement in the last 24 hours. A quiet window is a reading too: the watch ran, the records held.

Get the alert the day this estate moves Nameserver, mail, registrar, or CA change - in your inbox or webhook within minutes, signed reading attached. Alert subscriptions ride the paid rungs - see the plans.

Set up the watch →

Your job here Security: the hijack window → Vendor risk: evidence → Infrastructure: know first →