September 10, 2026

GitLab Locks Down Its Certs, and a Domain Slips Off Cloudflare

Out of roughly 45,000 DNS changes spotted across 24.4 million tracked domains in the last day, a few tell real stories once you read between the record types.

GitLab tightens its certificate policy

www.gitlab.com (fronted by Cloudflare) added a long, deliberate CAA record set — explicit issue entries for amazon.com, amazonaws.com, digicert.com, globalsign.com, letsencrypt.org, pki.goog, sectigo.com, and ssl.com, plus wildcard equivalents and cansignhttpexchanges=yes flags, along with an iodef contact for security@gitlab.com. That's a textbook CAA hardening move: instead of letting any public CA issue a cert for the domain, GitLab is now explicitly whitelisting which CAs are allowed to — and telling them where to report policy violations.

A domain quietly leaves Cloudflare's shelter

hka11.cc dropped Cloudflare nameservers (dell.ns.cloudflare.com, jeremy.ns.cloudflare.com) for a.share-dns.com / b.share-dns.net, moved off Cloudflare's network (AS13335) to AS50131, and picked up a new CNAME pointing at t87eqkv9.bsn2027.com. Hosting classification flipped from "Cloudflare (cdn)" to "unknown." Losing Cloudflare's proxy while adding an opaque CNAME chain like this is the kind of pattern worth keeping an eye on — it often shows up when a domain moves into throwaway or redirect-style infrastructure.

Squarespace loses one to Azure

tethee.com and www.tethee.com swapped their Squarespace CNAME (ext-sq.squarespace.com) for an Azure Static Web Apps target (gray-pebble-0da6b270f.3.azurestaticapps.net), and their network hop moved from AS53831 to Microsoft's AS8075. The TXT records tell the same story from the verification side — a Google site-verification token was removed and a new host-specific verification string appeared in its place. Looks like a clean rebuild on a new stack rather than a lift-and-shift.

Also in the logs

  • sp105.pl had its CAA restrictions to certum.pl/letsencrypt.org stripped, swapped nazwa.pl nameservers for ns1/ns2.seohost.pl, and rewrote its SPF record to redirect to _spf-h90.microhost.pl — a full hosting handover in one pass.
  • deinenotarin.at was our most restless domain, flapping through 6 changes in the window — worth a look if you're the one running it.
  • cheats4game.com and its www variant moved mail and nameservers from webhostarena.com to Namecheap hosting and Jellyfish Systems mail, alongside a tightened SPF policy (~all restored).

Nothing dramatic today, but plenty of small signals — cert policy hardening, quiet CDN exits, and clean re-platforming — that are worth knowing about before they show up as an outage ticket.