# DomainDrift - Internet Telemetry Index
# https://domaindrift.io

DomainDrift maintains a catalog of ~809,000 domains and re-scans 7,000 of them every day, sweeping the whole catalog in under 108 days. It records DNS records, TLS certificates, WHOIS data, HTTP probes, email authentication and DNSSEC. Every observation is Ed25519-signed with provenance receipts, and there are 46.3 million of them on record.

## Try it with no key

GET /v1/domains/:domain - a PREVIEW of the latest signed snapshot for ONE domain, no API
key required.

    curl https://domaindrift.io/v1/domains/example.com

The keyless response is a real, current preview, not the full record. It carries the derived
facts: who runs the nameservers, mail and CDN; the certificate issuer and expiry date; whether
the site is reachable; when it was scanned; the snapshot id; and per-type RECORD COUNTS. It also
carries a pointer to the Ed25519 receipt (id + the full record's output_hash + a public
/receipts/:id URL you can resolve with no key) so you can see the signed commitment exists.

The preview is NOT signed, deliberately: a signature commits to the exact bytes of the FULL
record, so one attached to a reduced subset could never verify. Withheld keyless: the DNS record
VALUES (A/AAAA/MX/NS/TXT/CNAME/SOA/CAA/SRV), certificates, subdomains, WHOIS, probe headers,
history, the provenance chain, and every bulk surface.

Limits: 1 request per 15 seconds per IP, under a shared global daily ceiling. Every response
carries X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset.

An API key returns the COMPLETE signed record on the same URL, and the receipt above
verifies against it. Lists, history, bulk, and exports require a key.

## API (X-DomainDrift-Key header)

GET /health - Service health (public, no auth)
GET /v1/domains - Paginated domain list
GET /v1/domains/:domain - Latest signal snapshot (keyless: a reduced preview; keyed: full)
GET /v1/domains/:domain/history - Time-series snapshots
GET /v1/domains/:domain/provenance - Receipt chain
GET /v1/domains/:domain/bundle - Signed evidence bundle export (verifies offline against published keys; allowance on paid plans)
GET /v1/changes - Global change feed
GET /v1/stream - SSE event stream

## Pay per call (x402)

Selected read endpoints accept per-request x402 payment (USDC on Base) with no account
at all. The live lane state, terms and worked example: https://domaindrift.io/agents

## MCP

POST https://domaindrift.io/mcp - a read-only MCP server (streamable HTTP, stateless). Five
tools: lookup_domain, whats_changed_today, resolve_receipt, internet_tape, signing_keys.
Descriptor: https://domaindrift.io/.well-known/mcp.json
Who serves an MCP descriptor at /.well-known/mcp.json, from our own scan data, stated against
the domains actually asked and never against the catalog: https://domaindrift.io/mcp-adoption
Every tool is a name for an existing HTTP route and is served through the SAME access lanes:
keyless tool calls get the reduced preview under the same per-IP throttle and shared daily
ceiling; send a DomainDrift API key as an Authorization: Bearer header to open the complete
record on your metered allowance.

## Who it is for

One page per buyer, each mapping live features onto that job:

- https://domaindrift.io/for/small-business - site, email and certificate watched, in plain language, with a signed record
- https://domaindrift.io/for/agencies - every client domain in one place, one alert destination per client, a report you can hand over
- https://domaindrift.io/for/portfolio - portfolio watch, nameserver/registrar/status alerts, expiry ladder, signed sale/dispute evidence
- https://domaindrift.io/for/infra - infrastructure change events (hosting, mail, CDN, certs) as timestamped, dated triggers, by API
- https://domaindrift.io/for/security - bring-your-own watchlists, email-authentication and DNSSEC drift, per-plane signed events
- https://domaindrift.io/for/compliance - continuous vendor monitoring, signed posture-on-a-date evidence, browser verifier

## Access

Product documentation (every feature + the API, explained): https://domaindrift.io/docs
API console + the public/metered board: https://domaindrift.io/api
Sign in with your DRM3 account at https://drm3.network/account (DomainDrift is enabled from the app catalog). Programmatic access uses an X-DomainDrift-Key (dd_) API key.

## Related

- Status: https://status.drm3.network
- Products: https://status.drm3.network/products.json
- Signing keys: https://domaindrift.io/.well-known/domaindrift-keys.json

DRM3 is a data infrastructure company. https://drm3.io