A university's SPF sprawls, and a domain drops all its CAA locks

Out of roughly 45,510 DNS changes tracked across about 32 million domains in the last day, most were the usual shuffle — but a few stood out for what they reveal about how mail security and hosting get managed (or mismanaged) in the wild.

The SPF record that kept growing

lboro.ac.uk (Loughborough University) rewrote its SPF record, folding in new senders like 40.85.92.201 and 148.253.151.170 alongside its long-standing list of mail relays (Flywire, Fraedom, Mandrill, Office 365, and more). It also added fresh verification TXT records for access-domain-verification, cisco-ci-domain-verification, and google-site-verification, and flipped its hosting classification from unknown to direct. SPF records like this are a good reminder of how quickly they sprawl as an org onboards new SaaS tools — every vendor wants a line in there.

A CAA record wiped clean

consultoff.business removed a CAA record that had explicitly authorized nearly every major CA — Let's Encrypt, DigiCert, Sectigo, GoDaddy, Amazon, Google, Microsoft, and more. Having that full allowlist is a hardening move (it restricts who can issue certs for your domain); deleting it entirely reopens the door to any CA. Worth a second look if it's your domain.

Domain flipped, mail shut off

25yearsofprogramming.com dropped its parking nameservers (parkingcrew.net) in favor of ns1.namepros-dns.com / ns2.brokerage.ns.namepros-dns.is — the telltale sign of a domain moving through a NamePros brokerage sale. Its SPF record was simplified down to a flat v=spf1 -all, meaning no mail should be sent from it at all right now, and its old MX (mail.h-email.net) and Let's Encrypt CAA entry were both removed. Classic "domain in transit" fingerprint.

Migrations worth noting

www.trickroper.com moved off HostGator (ns1719/ns1720.hostgator.com) onto Hostinger, swapping in mx1/mx2.hostinger.com for mail and updating its SPF to include:_spf.mail.hostinger.com — network shifted from AS19871 to AS47583.
cookwarediningware.com left Cloudflare's CDN entirely, landing on AS15169 (Google's network) with a new CNAME to ghs.google.com and nameservers from domainesia.net.
17222.com.cn swapped Cloudflare nameservers for AliDNS (ns1/ns2.alidns.com) and picked up a CNAME to expired.hichina.com — usually a sign a domain has lapsed and is now parked by its Chinese registrar.
www.kresto-tracking-dns.com picked up StackPath as its CDN, moving from a direct AS62370 setup onto StackPath's AS12989.

Small changes, but each one is a little breadcrumb trail of who's migrating, who's selling up, and who's rethinking their mail security posture.