Two migrations land on Vercel, one bails from Cloudflare

Out of roughly 21.7 million tracked domains, we clocked 25,671 changes and 255,092 brand-new domains in the last 24 hours. Most of it is routine housekeeping, but a few moves stood out.

Vercel picks up two new tenants

eliap.com.br swapped its old uni5.net hosting for Vercel — nameservers now point to ns1.vercel-dns.com / ns2.vercel-dns.com, and it picked up CAA records authorizing letsencrypt.org, pki.goog, and sectigo.com. It also dropped its old lockdown SPF (v=spf1 -all) and its MX record entirely, so no mail is expected there anymore.

jumbosskitchens.com made the same jump, but from a different starting point: it left Cloudflare's CDN for Vercel's, with network AS13335 → AS16509 and matching CAA additions for globalsign.com, letsencrypt.org, pki.goog, and sectigo.com. Two very different domains, same destination.

Meanwhile, some sites are leaving Cloudflare

Not everything flows toward Cloudflare. affinitysafaris.com (and its www host) moved off Cloudflare's network entirely, switching to GoDaddy's ns19.domaincontrol.com / ns20.domaincontrol.com and landing on AS16509. Along the way it lost its SPF include for eig.spf.a.cloudfilter.net and its MX record — a sign the mailbox setup is being rebuilt from scratch. 8gdd.com made a similar exit, moving from Cloudflare's AS13335 to AS210334 with hosting flipping from "cdn" to "unknown."

Domains climbing out of parking

blottered.com and tabbrowser.info both shed their parkingcrew.net nameservers in the same window, along with matching SPF records (ip6:fd1b:212c:a5f9::/48 -all) and MX entries pointing at mail.h-email.net. Identical parking fingerprints disappearing from two unrelated-looking domains at once usually means a parking network cleanup or an ownership change — worth a second look if either name is on your radar.

Cert policy tightening (and one loosening)

wavemax.com.br added a serious CAA record: comodoca.com, digicert.com, letsencrypt.org, pki.goog, and ssl.com as allowed issuers, plus an iodef contact at soc@wavemax.com.br for violation reports — a textbook cert-issuance hardening move.

On the flip side, lyf.cl moved onto Cloudflare's nameservers (emily.ns.cloudflare.com, tim.ns.cloudflare.com) and swapped a strict SPF tied to ip4:131.221.33.75 -all for a softer ip4:200.111.152.50 ~all. If you're relying on that domain for mail authentication, that's a meaningful loosening of the policy.