DomainDrift: verifiable internet telemetry

Name: Pistachio
Author: DRM3 Labs Corp.

Domains on a loop, watched ones re-checked every 5 minutes. Every DNS, host, email, and certificate change recorded with a signed receipt the moment we see it.

Robert ChristianJuly 12, 20263 min read

TruthFoundry: ask the record if a thing is true TruthFoundry: a fact record you can check

Editor's note: this post is from 2026-07-12 and its scale figures are left as written. The catalog has grown a great deal since; look up any domain and see its current coverage at domaindrift.io.

DomainDrift watches around 50,000 domains on a loop and signs every observation. When a domain's DNS, host, email posture, or certificate moves, the change is the event: what it was, what it became, and when we saw it.

The internet's configuration moves constantly, and it moves silently. DomainDrift turns those silent moves into a record you can search, watch, and hand to someone else as evidence.

DomainDrift: around 50,000 domains on a loop, every change signed. — DomainDrift, live at domaindrift.io

The change is the event

A nameserver that moved is how a hijack starts. A certificate that reissued off schedule is how impersonation starts. A mail record that weakened is how spoofed invoices start. A host that went dark is how an outage announcement starts, and you want to be the one making it, not receiving it.

DomainDrift records each of these as a first-class event with a before, an after, and a timestamp. You never have to wonder whether something changed: the record says what changed, and when. If you run a portfolio, watch your vendors, track competitors, or answer to clients for infrastructure you do not control, this is the feed you check in the morning.

What a scan sees

Each pass sweeps the full catalog roughly every 21 hours and records every plane that matters operationally: DNS across nine record types, TLS from certificate transparency, WHOIS over RDAP, ASN, DNSSEC, and robots.txt. The methodology documents exactly what it touches and what it never does. It is not a crawler, and it never reads page content.

Evidence, not screenshots

Every observation carries an Ed25519 receipt written the moment it is made, and receipts verify in your browser against published keys. When you need to show a registrar, a client, or an auditor that a record changed on a specific day, you are not sending a screenshot. You are sending a signed observation they can check themselves.