September 23, 2026

A NationBuilder Switch, a Parked-Domain Hijack, and dell.com's TXT Tweak

Out of roughly 66,000 DNS changes spotted across about 29 million tracked domains in the last 24 hours, today's window is light on drama but has a few genuinely fun threads to pull — a nonprofit's migration, a couple of parked-domain switcheroos with fresh CAA records, and a one-line footnote from dell.com.

The NationBuilder + Cloudflare combo

nlpp.org swapped its nameservers from GoDaddy's ns51/ns52.domaincontrol.com to a full set of NationBuilder nameservers (ns10–ns14.nationbuilder.com), landed its network on Cloudflare (AS13335), and picked up an SPF record pointing at SendGrid (include:sendgrid.net). That's the classic fingerprint of an org moving its site onto NationBuilder's platform while letting Cloudflare front the traffic and SendGrid handle outbound mail — a pretty clean advocacy/nonprofit stack rebuild in one shot.

Elsewhere, www.zurresearch.com and zurresearch.com both jumped from AS8560 straight onto Cloudflare (AS209242), with a new canva-domain-verify TXT record appearing alongside — suggesting a Canva-built site now sitting behind Cloudflare.

Parked domains waking up

A few domains that had been sitting in parking limbo got new life today:

  • adigihive.com moved off Afternic's parking nameservers (ns1/ns2.afternic.com) onto ParkingCrew (ns1/ns2.parkingcrew.net), added a Let's Encrypt CAA record, and picked up a real-looking MX (mail.h-email.net) — parked domain becoming an actual mail-enabled site, or handed to a new owner.
  • rusxema.com dropped its Hostland nameservers and MX for a set of "parklogictestns1.com" nameservers while removing its Let's Encrypt CAA entry — the kind of CAA removal worth watching, since it can precede someone else issuing certs for the domain.
  • sastoursandtravels.com left ImprovMX and dns-parking.com behind for Vercel's nameservers (ns1/ns2.vercel-dns.com), while adding CAA entries for Let's Encrypt, Google Trust Services (pki.goog), and Sectigo — a domain gearing up for a real deploy.

Small ASN hops worth a glance

Plenty of quieter moves: 4u.to shifted from AS211443 to AS6698, nayada.net went from AS63473 to AS197540, and hktihl.com hopped from AS17444 to AS9269. None scream "incident," but ASN changes like these are usually the first visible sign of a hosting migration — worth a note if you're tracking any of these for uptime or security reasons.

And one for the "just noticed" file

dell.com quietly added a TXT record (work-accounts-domain-verification=...) — no NS, MX, or hosting changes, just a verification token, likely for a workspace/SSO integration going live behind the scenes.