Questions & glossary
What Daylight watches on the federal .gov web, how to read it, and what the terms mean. Everything here is observational and built on already-public data — see Methods for the sources and scope.
Frequently asked questions
How do I find out who owns a .gov domain?
Every U.S. federal .gov domain has a public owner record in CISA's dotgov-data repository. Daylight mirrors it: search the registry, or open a domain's page, to see the owning agency, its sub-agency, and the email listed as the domain's security contact — each entry timestamped and linked to the exact public source it was read from.
Is a .gov website tracking me?
Daylight loads each watched public .gov page once, the way a browser would, and writes down what the page loaded on its own: third-party trackers, session-replay tools that record your clicks and scrolling, and analytics — including analytics disguised as the site's own first-party traffic. It never fills in or submits anything. Open Floodlight, or a specific domain's page, to see what was observed and when.
What is session replay?
Session replay is a technique that records an individual visitor's actions on a page — mouse movement, scrolling, clicks, and sometimes keystrokes — and reconstructs the session for later playback. Daylight notes when a session-replay tool is present on a public .gov page; Daylight itself records no one and stores no visitor data.
What is a PIA, and what is a SORN?
A Privacy Impact Assessment (PIA) is a public document a federal agency is generally expected to publish when an information system collects personal data, describing what it collects and how it is protected. A System of Records Notice (SORN) is a notice published in the Federal Register when the government maintains a 'system of records' that can be retrieved by a personal identifier. Daylight searches the public record for these filings and shows the exact searches it ran, reporting only what was found or not found as of a given date — never a legal conclusion.
What is a Certificate Transparency log?
Certificate Transparency (CT) logs are public, append-only records of the TLS/SSL certificates that certificate authorities issue. Because a new subdomain usually gets its own certificate, these logs reveal when a name such as previews.example.gov first appears. Daylight reads CT logs to notice new federal subdomains — recording only that a certificate exists. It never connects to, probes, or authenticates to the host.
What is reverse-proxied (disguised) analytics?
Normally an analytics script loads from a third-party domain, which ad and tracker blockers can recognize and block. A reverse proxy can route that same analytics through a first-party path on the site's own domain, so it looks like the site's own traffic and evades blockers. Daylight flags a first-party endpoint whose path or request-body shape matches a known analytics tool — and only when a real analytics beacon is actually present.
Where does Daylight's data come from — is it official?
Every source is already public: CISA's dotgov-data repository, Certificate Transparency logs, live public page source, the Internet Archive, and the Federal Register. Daylight is an independent project. It is not a government site and is not affiliated with any agency. The Methods page lists every source and describes exactly how the watcher behaves.
Can I cite Daylight in an article?
Yes. Every observed change has a permanent, timestamped permalink with a one-click citation that includes a content fingerprint, and the underlying records are published as RSS and JSON feeds and a public JSON API. Point readers at the permalink and the linked public source so the claim is independently re-verifiable.
How often does Daylight update?
The ownership registry is diffed daily; new subdomains are reconciled nightly from CT logs; live pages are swept weekly; page snapshots are taken twice weekly. The Status page shows when each watcher last ran and flags any scheduler that has gone overdue.
Glossary
- Apex domain
- The registrable base of a domain — e.g. example.gov. CISA's public registry lists an owner for each federal apex .gov domain.
- Subdomain
- A name under an apex, e.g. previews.example.gov. Daylight learns of subdomains passively, from the certificates that appear in public Certificate Transparency logs.
- Security contact
- The email address published in the .gov registry as the point of contact for a domain's security issues. A contact on a domain foreign to the owning organization is one of Daylight's signals.
- PIA (Privacy Impact Assessment)
- A public assessment an agency generally publishes when a system collects personal information, describing the data and its safeguards.
- SORN (System of Records Notice)
- A Federal Register notice for a government system of records retrievable by a personal identifier.
- Certificate Transparency (CT) log
- A public, append-only log of issued TLS certificates. Reading it reveals new subdomains without ever contacting the host.
- Session replay
- Recording and reconstructing an individual visitor's on-page actions (movement, clicks, scrolling, sometimes keystrokes) for later playback.
- Reverse-proxied analytics
- Analytics served through a first-party path on the site's own domain so it resembles the site's own traffic and evades tracker blockers.
- Removal ledger
- Daylight's dated record of things that were present on a page and then vanished — a privacy notice, an agency seal, a tracker, or a form field — with the before/after preserved.
Still have a question, or spot something wrong? See Methods for how to reach us and dispute a record.