CONTINUOUS INTERNET TELEMETRY24H DRIFT1,332 material changesacross 1,113 domains · +878 vs yesterdayDNS DRIFT25 domains changed DNS providertop destination parity.domains · +21 vs yesterdayEMAIL DRIFT7 domains switched email providertop destination pphosted.com · +5 vs yesterdayNOW320 curated domains not answering-1,895 vs yesterdayERRORS2,307 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED8,294 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERtiktok.comDMARC enforcement downgraded: p=reject → no DMARC record24H DRIFT1,332 material changesacross 1,113 domains · +878 vs yesterdayDNS DRIFT25 domains changed DNS providertop destination parity.domains · +21 vs yesterdayEMAIL DRIFT7 domains switched email providertop destination pphosted.com · +5 vs yesterdayNOW320 curated domains not answering-1,895 vs yesterdayERRORS2,307 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED8,294 throttled or blocked our scanner429 rate-limit / 403 bot-blockMOVERtiktok.comDMARC enforcement downgraded: p=reject → no DMARC record

nsroot.net

Observed 2026-07-17T14:57:46.458725529+00:00 (4h ago). Every field below was attested with an Ed25519 signature at scan time.

Not responding
Registered withCSC Corporate Domains, Inc.
Also usesAtlassian
tranco_100k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat nsroot.net actually stands on - every host below is a signed observation
nsroot.net
NS
ns1.nsroot1.comns2.nsroot2.com
nsroot1.com + nsroot2.comanswers its DNS

DNS Records

TXT 7

  • v=spf1 a:mail.citigroup.com -all
  • 7OFDwj4PG5PHy8utWaXc3/toItJQJfg7Wjh6Pt/GS60dhkKOQbJTBhSxmSBtqZTysab67WVqmwsb7qZu+shL4g==
  • cisco-ci-domain-verification=4efdcff81eace689141a8d65ce539a77aab5f4ecd7047bfbf0f0871f3777693c
  • MS=ms46166979
  • paloaltonetworks-site-verification=16ab9667b86b9c0ce31d96b3842c464617d86540068e04d477d42e0974e0a301
  • atlassian-domain-verification=T8oH3Uw3jSiSub6NBGpPJdPGM9QcWpLv3MsS5Em9r4b5LtoUZqpvxacSblQ4D6yK
  • v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc.reports.rua@citi.com

NS 2

  • ns1.nsroot1.com
  • ns2.nsroot2.com

SOA 1

  • ns1.nsroot1.com hostmaster.citi.com

CAA 4

  • iodef "mailto:CAADNS@citi.com"
  • issue "digicert.com"
  • issue "globalsign.com"
  • issuewild ""

TLS Certificates (0)

None.

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for nsroot.net. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for nsroot.net <a href="https://domaindrift.io/t/nsroot.net"> <img src="https://domaindrift.io/badge/nsroot.net.svg" width="300" height="64" alt="DomainDrift signed observations for nsroot.net"> </a>

Ed25519 Receipt

Receipt ID
fdf43b57-7cbb-484b-b05f-ffd47a3b21f5
Output Hash
a31f3567cadf290603e3987ec8367762eef890bc868e19b5ba74847f81decdc2
Signature
ed25519:79f70b5c4bbc95231a12377916cd4d5e67fe11dd51fa7e13b26923c1043412f72749634f5ba4ba9193455078d1ba1cff412f06a181c3317f0a01222fe77dde08
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser