CONTINUOUS INTERNET TELEMETRY24H DRIFT5,762 material changesacross 5,364 domains · 24h to ~20m ago · -3,001 vs yesterdayNOW560 curated domains not reachablelast probe, steadySITE ERRORS34,304 sites serving errorslast probe · 5xx / 404 / TLSBOT DEFENSEbot defense observed on 156,289 sites429 rate-limit / 403 bot-block, a posture signalMOVERokta.comNo mail routes in the latest observation

dsw.nl

Observed Aug 2, 2026, 10:00 UTC (18h ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation - watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain
Up right now
Email byGoogle Workspace
Secured byLet's Encrypt
Also usesGoogle Search Console
IPv6 · 22 subdomains · tranco
Every line above is a signed observation. Check the math at the bottom of the page.
EVIDENCE OF WILDCARD DNSobserved 2026-08-02 10:00 UTC

DomainDrift asked this domain for a TXT record at a name nobody registers, and got an answer back. A domain that answers a name that was never created is answering names in general, and that is wildcard DNS.

Wildcard DNS clusters around domain parking, dynamic DNS and catch-all hosting. It is also a real attack surface: if every invented hostname resolves, then a hostname an attacker invents resolves too, which is the ground state for subdomain takeover and for phishing hosted under a name that looks legitimate.

This is evidence of wildcard behaviour, not a proven fact. It rests on one control name: a domain could legitimately serve a TXT record at exactly that name for an unrelated reason, and a wildcard that answers address records but not TXT records would not be caught here at all. What this reading is and is not.

INFRASTRUCTURE MAPwhat dsw.nl actually stands on - every host below is a signed observation
dsw.nl
A / AAAA
23.53.11.16423.53.11.1672600:1408:ec00:2e::1735:ba42600:1408:ec00:2e::1735:ba7
2600serves the site
NS
a7-64.akam.neta1-179.akam.neta12-66.akam.neta13-65.akam.net+2 more
akam.netanswers its DNS
MX
aspmx.l.google.comalt1.aspmx.l.google.comalt2.aspmx.l.google.comalt3.aspmx.l.google.com+1 more
Google Workspacereceives its email
TLS
www.mijndsw.nl
Let's Encryptissued its certificate

DNS Records

A 2

  • 23.53.11.164
  • 23.53.11.167

AAAA 2

  • 2600:1408:ec00:2e::1735:ba4
  • 2600:1408:ec00:2e::1735:ba7

MX 5

  • 1aspmx.l.google.com
  • 5alt1.aspmx.l.google.com
  • 5alt2.aspmx.l.google.com
  • 10alt3.aspmx.l.google.com
  • 10alt4.aspmx.l.google.com

TXT 9

  • apple-domain-verification=mCi90WerW0atmeV5
  • MS=F7D9B6D87EE3B1D506C73C24FFD6E783E1EEE822
  • QuoVadis=d5b08e1a-4978-4b19-a540-2d16ef39f3ba
  • google-site-verification=4jdtjrlab4ElzbDlYO0PrbNn8BOhx3vSN0OdTLeQqHM
  • google-site-verification=DLWcb6d2vvXe-6-i21vMuNUVQmabvggRi62f-k_CZMM
  • google-site-verification=q7neJ4rZdqMx6Xy9d9OTioDec80Whn1Ogvjd3ncxJkw
  • v=NTA7516-1;startdate=2025-12;enddate=2028-12;provider=zorgmail;ntamx=10 relay.zorgmail.nl
  • Dynatrace-site-verification=26621baf-9206-4576-8848-a335058ccd2a__iil9ujrpfm6fvbpqd40ifvk4lg
  • v=spf1 ip4:83.98.228.0/24 ip4:80.248.34.59 include:spf.simplemailservice.eu include:_spf.google.com include:_spf.zorgmail.nl include:spf.afas.online a ~all

NS 6

  • a7-64.akam.net
  • a1-179.akam.net
  • a12-66.akam.net
  • a13-65.akam.net
  • a20-66.akam.net
  • a26-65.akam.net

SOA 1

  • a1-179.akam.net hostmaster.dsw.nl

CAA 7

  • iodef "mailto:administrators_alert@dsw.nl"
  • issue "digicert.com"
  • issue "letsencrypt.org"
  • issue "pkioverheid.nl"
  • issue "quovadisglobal.com"
  • issue "sectigo.com"
  • issue "www.pkioverheid.nl"

MCP_RECORDS 1

  • v=spf1 -all

DMARC_RECORDS 1

  • v=DMARC1;p=reject;pct=100;rua=mailto:dmarc@03ebb6a7.uriports.com; sp=reject

BIMI_RECORDS 1

  • v=spf1 -all

MTA_STS_RECORDS 1

  • v=STSv1; id=20240304122153Z;

TLS Certificates (3)

Common NameIssuerExpires
www.mijndsw.nl C=US, O=Let's Encrypt, CN=YR1 Mon, 07 Sep 2026 09:04:42 +0000
YR1 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (22)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Ed25519 Receipt

Receipt ID
rcpt_add08580c6f266b8
Output Hash
c1302867ab4626b727ef4de24e8cf9a98e05e0b37dcca544a25cac6eab4ea3d6
Signature
ed25519:7eb8c36dc17ef5d4c2858df0b506e685409f1bd68026944138370ebd97161cf49ac183b746b8a2d16a47d1f689ba4372e6563ba693981e8a4bd617a1e640dc0c
Public Key
ed25519:4859bb613d650e12dd7478cc307c73a8712fabc115a9dc59f65534ed3c09a8f9
Parent
(genesis)
Plane
fast
Verify this in your browser