CONTINUOUS INTERNET TELEMETRY24H DRIFT1,421 material changesacross 1,214 domains · +512 vs yesterdayDNS DRIFT49 domains changed DNS providertop destination parity.domains · +23 vs yesterdayEMAIL DRIFT19 domains switched email providertop destination google.com · +11 vs yesterdayCERT DRIFT46 domains switched issuing CA24h · +23 vs yesterdayNOW2,654 curated domains not answeringlast probe, steadyERRORS23,785 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED90,626 throttled or blocked our scanner429 rate-limit / 403 bot-block

sanity.io

Observed Jul 21, 2026, 19:10 UTC (6h ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onGoogle
Email byGoogle Workspace
Secured byLet's Encrypt
Also usesHubSpotStripeGoogle Search ConsoleMiroFacebook/MetaNotionLinear
cms
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat sanity.io actually stands on - every host below is a signed observation
sanity.io
A / AAAA
35.186.225.23
Googleserves the site
NS
ns-cloud-b3.googledomains.comns-cloud-b4.googledomains.comns-cloud-b2.googledomains.comns-cloud-b1.googledomains.com
googledomains.comanswers its DNS
MX
aspmx2.googlemail.comaspmx3.googlemail.comalt1.aspmx.l.google.comaspmx.l.google.com+1 more
Google Workspacereceives its email
TLS
sanity.io
Let's Encryptissued its certificate

DNS Records

A 1

  • 35.186.225.23

MX 5

  • 10aspmx2.googlemail.com
  • 10aspmx3.googlemail.com
  • 5alt1.aspmx.l.google.com
  • 1aspmx.l.google.com
  • 5alt2.aspmx.l.google.com

TXT 24

  • reachdesk-verification=gMIPtJcOwsgpoOprSQZtsCZEhXk6ic6g1iv5T19NbuJ4pxDtBGDnTUOvJnH97S5B
  • v=spf1 include:_spf.google.com include:servers.mcsv.net include:2995520.spf02.hubspotemail.net include:stspg-customer.com include:mktomail.com include:mg-spf.greenhouse.io ~all
  • cursor-domain-verification-t2afr6=TJb54CifLsSu3nozFuRuQ6GML
  • stripe-verification=978242b72452abac4725286f6a92f52e92601a77c33cb9a92bd159ec8b539311
  • MS=ms70569628
  • google-site-verification=TP_cT3Qi4pYwEhe7y1cEoWQ2IkLixee7OSr9QCJFji0
  • anthropic-domain-verification-w83k0d=LVLCwFFMqSsr91hz1K2Yi3xvf
  • DirectFedAuthUrl=https://sanity.okta.com/app/sanity_azure_1/exkijinrpbfxRfRGr357/sso/saml
  • DFBCFE3B07
  • status-page-domain-verification=n5f7bptvc83p

NS 4

  • ns-cloud-b3.googledomains.com
  • ns-cloud-b4.googledomains.com
  • ns-cloud-b2.googledomains.com
  • ns-cloud-b1.googledomains.com

SOA 1

  • ns-cloud-b1.googledomains.com cloud-dns-hostmaster.google.com

CAA 4

  • issue "pki.goog"
  • issue "sectigo.com"
  • issue "letsencrypt.org"
  • issue "digicert.com"

TLS Certificates (3)

Common NameIssuerExpires
sanity.io C=US, O=Let's Encrypt, CN=YR2 Wed, 30 Sep 2026 02:23:32 +0000
YR2 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for sanity.io. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for sanity.io <a href="https://domaindrift.io/t/sanity.io"> <img src="https://domaindrift.io/badge/sanity.io.svg" width="300" height="64" alt="DomainDrift signed observations for sanity.io"> </a>

Ed25519 Receipt

Receipt ID
rcpt_4c9287cc2f7bb13c
Output Hash
f2960d34b9e14d835d50ad54440efbdce473d5abd239296226ac15e782e26c56
Signature
ed25519:9fdc358cc9bba305b1c4d74d51b19d82af3153141e116b5c4676f13684959c3982a913e23e633794bfd753a5fa7ccf9c7488983b552708a425488fa7202d9002
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser