removed include:sendgrid.net
Certificate Transparency · gTLD zone files · DNS — read nightly
A live record of when every company on the internet started, and what changed since.
We read every gTLD zone file, every certificate log and every DNS record, nightly. When a company appears, adopts a tool, drops a vendor, starts hiring, or hardens its infrastructure — we have the date.
Debut
We see a company the day it appears.
38% of domains born yesterday reach their first commercial signal within 30 days
Movement
We see what changed while you slept.
- northwind.com removed include:sendgrid.net 3 days ago
- northwind.com added include:_spf.postmarkapp.com 3 days ago
- lumen-labs.io first certificate issued yesterday
- harborpay.co DMARC policy p=none → p=quarantine 6 days ago
14 Mar 16 Mar 09 Jun 14 Aug today
Who reads FirstSeen
Vendors
Know who switched — before your reps hear it from a lost deal.
Category feeds of who adopted a competitor, who left one, and where install-base share is moving.
For competitive intel → InvestorsFind companies before they announce, and size a thesis honestly.
Filtered entrant feeds and cohort data — where the absence of a result is as trustworthy as its presence.
For research + diligence → RevOpsFire the moment an account crosses a threshold worth acting on.
Watched lists and webhook events into your CRM — latency and integration, not breadth.
For sales triggers →Also used by agencies and B2B service businesses to spot newly formed companies in their market — see how.
1,022 gTLD zones read nightly
287.4M domains in the Census
3.9M Movements detected · last 7d
Jan 2024 archive start
The atomic unit
What a Movement looks like
One detected change on one domain, dated. Added in green, removed in red — every screenshot reads at a glance.
added include:_spf.postmarkapp.com
first certificate issued
DMARC policy p=none → p=quarantine
MX → Google Workspace
added checkout.shopify.com + klaviyo
The moat
Why nobody else has the date
01
Population, not sample
Zone files cover every registered gTLD domain — not a crawl of the well-linked web. If it exists, it's in the Census.
02
Change, not state
A list of who uses what is commodity. Knowing the day a vendor was added or dropped is not — and it's what we record.
03
Day zero, not post-scale
Technographic vendors need a company to already exist at scale. DNS and Certificate Transparency do not. We see the debut.
25 Movement types
Subscribe to a Signal
Each Signal is a saved query over the Census. Six of twenty-five:
Birth Signal
First certificate
The first TLS certificate is issued for a domain — the earliest sign of real intent.
~~1.6M/mo Commercial Signal
Commerce platform adopted
Shopify, BigCommerce, WooCommerce or similar detected for the first time.
~~88k/mo Growth Signal
ATS adopted
An applicant-tracking system (Greenhouse, Lever, Ashby) is wired up.
~~31k/mo Stack Signal
ESP switched
One email provider removed and another added inside a short window — a switch.
~~24k/mo Maturity Signal
DMARC hardened
DMARC policy moves p=none → quarantine or reject — the org got serious about email.
~~72k/mo Opportunity Signal
Registered but parked
A domain registered 30+ days ago still has no real site — a build opportunity.
~~380k/moThe Census · Research
The Email Infrastructure Brief — Q2 2026
Who won and lost ESP share among companies founded in the last 18 months — measured on the day each switch happened, across 287M domains.
Read the report → CSV included · free
Query it like data — or hand it to an agent
REST API and an MCP server
Movements are objects. Pull them into a warehouse, or let an agent ask the question directly. MCP is metered on queries, not seats.
API + MCP docs →# MCP — ask in natural language
tool: firstseen.movements
prompt: "which of my accounts added a
competitor's ESP this quarter?"
# REST — same data, typed
GET /v1/movements?type=esp_switched
&from=postmark&since=2026-04-01