A Palestinian domain jumps to Cloudflare, and gov.uk just ticks

Out of roughly 23.8 million tracked domains, we saw 32,148 changes and 264,953 brand-new domains in the last 24 hours. Most of it is routine churn, but a few moves stood out.

Cloudflare keeps eating the world

Several domains landed on Cloudflare's nameservers today. fdc.ps moved off Palestinian provider Hadara (AS47583) entirely — swapping cdns1.hadara.ps / cdns2.hadara.ps for Cloudflare's etta.ns.cloudflare.com and lewis.ns.cloudflare.com, and picking up a Cloudflare-flavored MX record (_dc-mx.d699452eb915.fdc.ps) in the process. Similarly, notariusi.info left a DNS-parking setup (apollo.dns-parking.com) for Cloudflare, and nrvfashion.com ditched GoDaddy-adjacent nameservers (ns1.reliablesecureserver.com) and its old SPF record for Cloudflare too. cavtat-sunrise-apartments.com made the same jump, dropping a.share-dns.com/b.share-dns.net for Cloudflare's kayleigh and koa nameservers.

Domain drama: crystaljet.com escapes Alibaba

crystaljet.com and its www counterpart quietly unwound a pile of Chinese hosting infrastructure: gone are dns17.hichina.com/dns18.hichina.com (Alibaba's DNS) along with a stack of verification TXT records for Aliyun, Afternic, and a CN-verify token. In their place: Afternic's parking nameservers (ns3.afternic.com, ns4.afternic.com) and a locked-down v=spf1 -all record. Looks like a domain sale or parking listing in progress. sign233.com told a similar story, moving from NamePros brokerage nameservers to meilun.ns.giantpanda.com and jumping ASN from AS16509 (Amazon) to AS63949 (LeaseWeb).

Small security tidies

A handful of domains cleaned up their CAA and mail auth in one pass. 2lrn4.com swapped AWS inbound mail (inbound-smtp.eu-west-1.amazonaws.com) for ProtonMail's mail.protonmail.ch / mailsec.protonmail.ch, added a protonmail-verification= TXT record, and tightened its SPF to include:_spf.protonmail.ch -all. Meanwhile eskia.de stripped out CAA records for both Let's Encrypt and Google Trust Services along with its nameservers, moving networks from AS20473 to AS21245 — the kind of full teardown that usually precedes a re-parking or migration.

One quiet giant

Even gov.uk, sitting behind Fastly, made an appearance — just a routine TXT timestamp rotation, nothing dramatic. A good reminder that most of this daily churn is background noise; the interesting bits are the handful of domains actively changing hands, providers, or continents.