CONTINUOUS INTERNET TELEMETRY24H DRIFT2,523 material changesacross 2,302 domains · -28 vs yesterdayDNS DRIFT15 domains changed DNS providertop destination cloudflare.com · -1 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination google.comCERT DRIFT2 domains switched issuing CA24h · -3 vs yesterdayNOW3,335 curated domains not answeringlast probe, steadyERRORS10,917 responded with an errorlast probe · 5xx / 404 / 429 / 40324H DRIFT2,523 material changesacross 2,302 domains · -28 vs yesterdayDNS DRIFT15 domains changed DNS providertop destination cloudflare.com · -1 vs yesterdayEMAIL DRIFT5 domains switched email providertop destination google.comCERT DRIFT2 domains switched issuing CA24h · -3 vs yesterdayNOW3,335 curated domains not answeringlast probe, steadyERRORS10,917 responded with an errorlast probe · 5xx / 404 / 429 / 403

ubuntu.com

Observed 2026-07-13T00:04:44.532073715+00:00 (1d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Runs onCanonical Group Limited
Secured byLet's Encrypt
Registered withMarkMonitor Inc.
Also usesGoogle Search Console
IPv6 · 1 subdomain · open_source
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat ubuntu.com actually stands on - every host below is a signed observation
ubuntu.com
A / AAAA
185.125.190.29185.125.190.21185.125.190.202620:2d:4000:1::28+2 more
Canonical Group Limitedserves the site
NS
ns1.canonical.comns2.canonical.comns3.canonical.com
canonical.comanswers its DNS
MX
mx.ubuntu.com
ubuntu.comreceives its email
TLS
ubuntu.com
Let's Encryptissued its certificate

DNS Records

A 3

  • 185.125.190.29
  • 185.125.190.21
  • 185.125.190.20

AAAA 3

  • 2620:2d:4000:1::28
  • 2620:2d:4000:1::26
  • 2620:2d:4000:1::27

MX 1

  • 10mx.ubuntu.com

TXT 4

  • v=spf1 include:_spf.canonical.com include:spf.forwardemail.net ~all
  • forward-email-site-verification=6IsURgl2t7
  • google-site-verification=8CcvY6fsgRbiFk2nyEaiA9rE-ykXOcWUPjJKlO6P4vk
  • v=DMARC1; p=none; pct=100; rua=mailto:dmarc-rua+ubuntu@admin.canonical.com

NS 3

  • ns1.canonical.com
  • ns2.canonical.com
  • ns3.canonical.com

SOA 1

  • ns1.canonical.com hostmaster.canonical.com

CAA 6

  • issuewild "digicert.com"
  • issuewild "letsencrypt.org"
  • issue "letsencrypt.org"
  • iodef "mailto:is-admin@canonical.com"
  • issue "letsencrypt.org; accounturi=https://acme-v01.api.letsencrypt.org/acme/reg/32541290"
  • issue "digicert.com"

TLS Certificates (3)

Common NameIssuerExpires
ubuntu.com C=US, O=Let's Encrypt, CN=YR1 Wed, 30 Sep 2026 04:13:35 +0000
YR1 C=US, O=ISRG, CN=Root YR Sat, 02 Sep 2028 23:59:59 +0000
Root YR C=US, O=Internet Security Research Group, CN=ISRG Root X1 Thu, 02 Sep 2032 23:59:59 +0000

Subdomains (1)

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for ubuntu.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for ubuntu.com <a href="https://domaindrift.io/t/ubuntu.com"> <img src="https://domaindrift.io/badge/ubuntu.com.svg" width="300" height="64" alt="DomainDrift signed observations for ubuntu.com"> </a>

Ed25519 Receipt

Receipt ID
0159036d-cd45-429a-927d-0274100f25d1
Output Hash
4469a63ebfea9d99382fd97eff692794b087d7dd5c34fc0d3ee084be529dc010
Signature
ed25519:acde0775e9d54ecf11a3cc67883f7c4809dc3e698f4dfbcbebad715ce277e6ba1b5ab69b1ce579561b51d195e0ef1cb35119013210e1aed837aeabf538a42b0e
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser