Cloudflare comebacks, a quiet Marubeni domain, and CAA lockdowns

Out of roughly 31 million tracked domains, we saw 47,481 changes and about 530,000 new domains show up in the last 24 hours. Most of it is routine SPF shuffling and nameserver housekeeping, but a few changes tell real stories.

bikkart.fr grabs the Cloudflare + Google combo

French site bikkart.fr made a clean, full-stack move: nameservers switched from ns0.online.net/ns1.online.net (Scaleway/Online.net, AS396982) to Cloudflare's amit.ns.cloudflare.com and melody.ns.cloudflare.com, its network flipped to Cloudflare (AS13335), and hosting class went from unknown to Cloudflare CDN. At the same time it added an MX record pointing at smtp.google.com.bikkart.fr — a textbook "move the site to Cloudflare, move the mail to Google Workspace" migration, all in one pass.

thronefinder.net quietly leaves Cloudflare

Not everyone's migrating onto Cloudflare — some are stepping off. thronefinder.net went from sitting behind Cloudflare's network and CDN (AS13335/AS16509, hosting class "cdn") to just AS13335/AS16509 with hosting class reset to "unknown." That's the DNS-level fingerprint of someone disabling Cloudflare's proxy or dropping the account entirely.

A corporate domain goes to the parking lot

marubeni-specialty.com had its nameservers swapped from a real operational set (bmw-3.kddnet.de, ns.kew.net, plus rcode0.eu/rcode0.net DNSSEC secondaries) over to ns1.parkingcrew.net and ns2.parkingcrew.net, gained an MX at mail.h-email.net, and moved from AS9597 to AS206834. That combination — real infra to parking nameservers — usually means a domain lapsed and got scooped into a parking/monetization network rather than staying with its original owner.

Marketing platforms and mail hygiene

enddebtgetcredit.com swapped its mail setup for Salesforce Marketing Cloud infrastructure: MX now includes reply.s13.exacttarget.com, and its SPF record was rewritten to include:cust-spf.exacttarget.com. It also moved off third-party nameservers (vernalweb.com) onto self-hosted ones (ns1.enddebtgetcredit.com, ns2.enddebtgetcredit.com) and jumped from AS30277 to AS209389 — a fairly complete re-platforming.

CAA tightening

Several domains added CAA records limiting certificate issuance to Let's Encrypt today, including sentris.com, solartii.ru, and www.2000cn.com.au. A few others went the other direction and removed CAA restrictions entirely (forumjitu.com, nobetcieczanelistesi.com). It's a small but useful reminder: CAA is one of the cheaper ways to stop a rogue CA from issuing certs for your domain, and today's data shows plenty of admins still actively tuning it.