September 4, 2026

DNS Watch: CAA locks come off, and a parking carousel spins up

Out of 22.8 million tracked domains, 26,537 changed something in their DNS in the last 24 hours. Most of it is routine — SOA serial bumps, SPF tweaks — but a few patterns stood out.

Someone's loosening the locks

CAA records exist to tell certificate authorities "only these CAs may issue certs for me." Two sites went the opposite direction today: nevco.com (on Cloudflare) removed a whole slate of CAA restrictions — amazonaws.com, letsencrypt.org, pki.goog, sectigo.com, ssl.com, plus wildcard entries — leaving the domain with no CAA constraints at all. www.mellowcovers.com (on Shopify) did the same, dropping digicert.com, globalsign.com, letsencrypt.org, pki.goog, and ssl.com from its CAA set. Neither is inherently malicious, but pulling CAA protection wide open is worth a second look if you run either domain — it's the kind of change that's easy to miss and easy to abuse.

A parking carousel

blocblast.com and its www variant swapped their nameservers to ns1.parkingcrew.net / ns2.parkingcrew.net, picked up a CAA record for letsencrypt.org, an MX pointing at mail.h-email.net, and a distinctive TXT record (v=spf1 ip6:fd1b:212c:a5f9::/48 -all). That exact signature — parkingcrew NS, letsencrypt CAA, and that same IPv6 SPF block — is also what dropped off labbuainain.com and webs-design.com within the same window, as they moved away from parking. It looks like parkingcrew's infrastructure is actively cycling domains in and out, and today we caught both directions in the same 24 hours.

Migrations of note

  • indohelper.com moved off GoDaddy nameservers (ns75/ns76.domaincontrol.com) onto Cloudflare (gordon.ns.cloudflare.com, sonia.ns.cloudflare.com), landing in AS13335.
  • hx0005.cc and www.hx0005.cc also freshly onboarded to Cloudflare, now resolving through AS209242/AS396982.
  • osakidetza.net dropped AWS Route 53 (ns-1379.awsdns-44.org and friends) in favor of ns1.itbatera.euskadi.eus / ns2.itbatera.euskadi.eus — a Basque public-sector domain apparently bringing its DNS in-house.
  • nesica.net swapped AWS Route 53 nameservers for a set of Akamai edge servers (a1-211.akam.net and others).
  • cilida.com picked up a CNAME to expired.hichina.com and switched to Alibaba's dns13/dns14.hichina.com — the classic signature of a lapsed domain landing in a registrar's expiration-parking page.

Small but telling

girexven.com swapped its whole mail stack — off jellyfish.systems MX servers and onto MailChannels relay, alongside a nameserver move from Namecheap hosting to BanaHosting. And www.artificiality.online did a full reverse-migration off Cloudflare back onto AS16509 (Namecheap-associated), swapping Zoho mail for registrar email forwarding in the same move — a tidy example of a domain unwinding its whole hosting setup at once.