DomainDrift 1.2: routine churn stops reading as news, and every change shows its severity

DomainDrift watches more than a million domains on a continuous loop and records what their infrastructure is doing: DNS, certificates, mail posture, registration, reachability. Every observation is signed the moment it is made.

Version 1.2 is about signal. A monitoring product is judged as much by what it stays quiet about as by what it reports, and this release teaches DomainDrift the difference between a domain changing and the internet doing its housekeeping. It also opens four new pages built around specific jobs.

Housekeeping is labeled as housekeeping

Certificates issued from the free automated pool get rotated by the platforms that manage them, on their own schedule, for their own reasons. That reissue is maintenance, and it should not land on your desk looking like an incident. DomainDrift now recognizes a rotation inside that pool as a routine renewal and badges it as one, instead of announcing that the certificate authority changed.

A real move is still a story. When a domain leaves that pool for a commercial authority, or arrives from one, that is a decision someone made about how they run their infrastructure, and it is reported as such.

Three things that used to pass in silence

A certificate that expired and was never renewed is now an event. Until this release DomainDrift could tell you an expiry was coming and then say nothing on the day it arrived. The lapse itself is now recorded, at the moment coverage ends.

A domain that was dropped and registered again is now an event. The name reads the same on both sides of that gap, but the registration changed hands, which is one of the loudest facts you can learn about a domain.

A confirmed total loss of mail routing or authoritative DNS is now an event. When a domain's mail goes dark, or it stops answering for itself, that is not a quiet field edit, and it no longer reads like one.

The scanner learning is not the domain changing

The first time DomainDrift sees a record set on a domain there is nothing to compare it against, so there is nothing that moved. That first look used to appear in the timeline as though something had. It no longer does: a first observation is recorded honestly as the scanner learning the domain, and counted as a change nowhere.

Every change carries a severity, and every count agrees

Each change now shows its class on the page: critical, notable, minor, routine, or baselining. The first three are material, the moves worth a person's attention, ranked so you can triage a busy day from the top. Routine is recorded churn. Baselining is the scanner's first look at a domain.

One classification decides this, and every surface counts the same way. A number you click always matches the rows you land on, because a count that disagrees with its own detail page is worse than no count at all.

Four pages for four jobs

DomainDrift now opens on your work rather than a general tour. There are pages for reliability engineering, security, managed service providers, and auditors.

Each one is built from live signed data, not a brochure: what an on-call engineer wants when a domain stops answering, what a security team watches across the names it does not own, what a provider has to be able to show a client, and what an auditor needs to hand to someone else.

That last one is the point of signing every observation. A signature proves who observed a thing and that the record has not been altered since. It is added accountability on our side, permanent and on the line, and it travels with every export.

Start at domaindrift.io: search a name you know, open its page, and see what has actually moved.