CONTINUOUS INTERNET TELEMETRY24H DRIFT1,190 material changesacross 1,020 domains · +736 vs yesterdayDNS DRIFT25 domains changed DNS providertop destination parity.domains · +21 vs yesterdayEMAIL DRIFT7 domains switched email providertop destination pphosted.com · +5 vs yesterdayNOW314 curated domains not answering-1,901 vs yesterdayERRORS2,256 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED8,276 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT1,190 material changesacross 1,020 domains · +736 vs yesterdayDNS DRIFT25 domains changed DNS providertop destination parity.domains · +21 vs yesterdayEMAIL DRIFT7 domains switched email providertop destination pphosted.com · +5 vs yesterdayNOW314 curated domains not answering-1,901 vs yesterdayERRORS2,256 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED8,276 throttled or blocked our scanner429 rate-limit / 403 bot-block

domtar.com

Observed 2026-07-17T12:21:23.717294856+00:00 (6h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCloudflare
Email byProofpoint
Secured byLet's Encrypt
Registered withNamescout Ltd
Also usesFacebook/MetaGoogle Search Console
fortune_500
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat domtar.com actually stands on - every host below is a signed observation
domtar.com
A / AAAA
141.193.213.10141.193.213.11
Cloudflareserves the site
NS
udns1.ultradns.netudns2.ultradns.net
ultradns.netanswers its DNS
MX
mxa-001d9701.gslb.pphosted.commxb-001d9701.gslb.pphosted.com
Proofpointreceives its email
TLS
domtar.com
Let's Encryptissued its certificate

DNS Records

A 2

  • 141.193.213.10
  • 141.193.213.11

MX 2

  • 10mxa-001d9701.gslb.pphosted.com
  • 10mxb-001d9701.gslb.pphosted.com

TXT 32

  • MS=ms53490593
  • wpe-verification=domtarwpe
  • 8fv3vsq5b7kdgm2wlg53q7y37v71nl6z
  • 8wv4cb53mj1326sf3tbt6crgnlz9qy1h
  • _8k3tv1kulc1eu4zosnkafwokuj7apyu
  • _ns6pk5f8il720d6z7hwgj9s35p70vv6
  • _odb3izbmrn112mrh5axl0camc5ygqi7
  • _wbuzu472ph9lqyn18kbbjgyyr1v7pjm
  • yrgf7cs3tgrwrz4614v740b29sbm2jtg
  • apple-domain-verification=VctOnrajgigUJksO

NS 2

  • udns1.ultradns.net
  • udns2.ultradns.net

SOA 1

  • udns1.ultradns.net admintelecom.domtar.com

SRV 7

  • expe-1.domtar.com:5060 p10
  • expe-2.domtar.com:5060 p10
  • expe-1.domtar.com:5061 p10
  • expe-2.domtar.com:5061 p10
  • expe-1.domtar.com:5269 p10
  • expe-2.domtar.com:5269 p10
  • autodiscover.domtar.com:443 p1

TLS Certificates (4)

Common NameIssuerExpires
domtar.com C=US, O=Let's Encrypt, CN=YE2 Thu, 24 Sep 2026 21:17:51 +0000
YE2 C=US, O=ISRG, CN=Root YE Sat, 02 Sep 2028 23:59:59 +0000
Root YE C=US, O=Internet Security Research Group, CN=ISRG Root X2 Thu, 02 Sep 2032 23:59:59 +0000
ISRG Root X2 C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for domtar.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for domtar.com <a href="https://domaindrift.io/t/domtar.com"> <img src="https://domaindrift.io/badge/domtar.com.svg" width="300" height="64" alt="DomainDrift signed observations for domtar.com"> </a>

Ed25519 Receipt

Receipt ID
bf63fabc-9840-42da-92ed-284c1df383b5
Output Hash
8649bae63bc583f4b58ffb2c05b4a0cdb2b0c85c4f1362c6f13b94a7fd9cb29f
Signature
ed25519:7fcfe2881212ca0b0aaee5a1035e4ed30e4ad95969af0e4e4efbb317508bc875039ff2add0b1fa85f69e8d5d45d3108d875ab185ecdbff4dd3a9d69606e9870e
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser