CONTINUOUS INTERNET TELEMETRY24H DRIFT201 material changesacross 161 domains · -457 vs yesterdayCERT DRIFT3 domains switched issuing CA24h · +1 vs yesterdayNOW3,808 curated domains not answering+979 vs yesterdayERRORS24,709 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED69,739 throttled or blocked our scanner429 rate-limit / 403 bot-block24H DRIFT201 material changesacross 161 domains · -457 vs yesterdayCERT DRIFT3 domains switched issuing CA24h · +1 vs yesterdayNOW3,808 curated domains not answering+979 vs yesterdayERRORS24,709 responded with an errorlast probe · 5xx / 404 / TLSTHROTTLED69,739 throttled or blocked our scanner429 rate-limit / 403 bot-block

onenote.com

Observed Jul 18, 2026, 12:45 UTC (2d ago). Every field below was attested with an Ed25519 signature at scan time.

Up right now
Email byMicrosoft 365
Secured byMicrosoft
Registered withCSC Corporate Domains, Inc.
Also usesGoogle Search Console
IPv6 · tranco_5k
Every line above is a signed observation. Check the math at the bottom of the page.
INFRASTRUCTURE MAPwhat onenote.com actually stands on - every host below is a signed observation
onenote.com
A / AAAA
23.35.28.572600:1408:ec00:89d::6112600:1408:ec00:882::611
2600serves the site
NS
ns1-132.akam.netusc4.akam.netasia1.akam.neteur2.akam.net+4 more
akam.netanswers its DNS
MX
onenote-com.mail.protection.outlook.com
Microsoft 365receives its email
TLS
cdn.onenote.net
Microsoft Corporationissued its certificate

DNS Records

A 1

  • 23.35.28.57

AAAA 2

  • 2600:1408:ec00:89d::611
  • 2600:1408:ec00:882::611

MX 1

  • 10onenote-com.mail.protection.outlook.com

TXT 7

  • v=DMARC1; p=reject; rua=mailto:onenotedmarcreports@service.microsoft.com
  • google-site-verification=g0T8UwzTUSzMZkQnOP0n_8d-IYx_kPlSalfRnkcVc6c
  • v=spf1 include:spf.protection.outlook.com mx a ptr ip4:137.117.65.22/32 ip4:168.61.25.60/32 ~all
  • MS=ms22278681
  • google-site-verification=xwpd-kZItZByIQVSPUqEr1OX-G6E4QbTS4Edx7wQ3Zc
  • MS=ms26986888
  • v=DMARC1; p=reject; rua=mailto:onenotedmarcreports@service.microsoft.com

NS 8

  • ns1-132.akam.net
  • usc4.akam.net
  • asia1.akam.net
  • eur2.akam.net
  • use9.akam.net
  • ns1-191.akam.net
  • asia3.akam.net
  • usw1.akam.net

SOA 1

  • asia3.akam.net hostmaster.akamai.com

CAA 4

  • issue "globalsign.com"
  • issue "digicert.com"
  • contactemail "caarecordaware@microsoft.com"
  • issue "microsoft.com"

TLS Certificates (3)

Common NameIssuerExpires
cdn.onenote.net C=US, O=Microsoft Corporation, CN=Microsoft TLS G2 ECC CA OCSP 02 Mon, 01 Feb 2027 22:09:28 +0000
Microsoft TLS G2 ECC CA OCSP 02 C=US, O=Microsoft Corporation, CN=Microsoft TLS ECC Root G2 Sun, 03 Jun 2029 20:02:02 +0000
Microsoft TLS ECC Root G2 C=US, O=DigiCert Inc, 2.5.4.11=www.digicert.com, CN=DigiCert Global Root G3 Tue, 19 Jun 2029 23:59:59 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for onenote.com. It updates itself. It attests a signed observation - not that the site is safe.

DomainDrift signed-observation badge for onenote.com <a href="https://domaindrift.io/t/onenote.com"> <img src="https://domaindrift.io/badge/onenote.com.svg" width="300" height="64" alt="DomainDrift signed observations for onenote.com"> </a>

Ed25519 Receipt

Receipt ID
79c038b7-d15b-4606-be20-6f7ec0c3289d
Output Hash
5a49f734e084e2bdd4aa3d744bf1aecdadfe47ed38c7bf472486b143fed8fcb5
Signature
ed25519:25adf06c9923d626e9a083c27ce2442c6a54f1a0efd2102077cb295ffd12d8529620f6b25cf9dacc8e68f8a610d80b7b4ba3c4e07cbc9d64590b2b4fd2da6b09
Public Key
ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent
(genesis)
Plane
fast
Verify this in your browser