October 1, 2026

Parking lots, auction blocks, and a wobbly gov.uk

Across the roughly 60,244 DNS changes we clocked in the last 24 hours (out of about 33 million tracked domains, with roughly 470,000 new domains showing up), most of the action is the usual background hum — SPF tweaks, NS swaps, SOA serial bumps. But a few threads stood out.

A domain auction cluster

Three unrelated-looking names — hws.info, www.aid.info, and bitwaddress.org — all show the same signature move today: CAA records for letsencrypt.org getting pulled, MX records pointing at mail.h-email.net disappearing, and nameservers shifting away from ns1.parkingcrew.net/ns2.parkingcrew.net. hws.info landed on ns1-auction.sav.com and ns2-auction.sav.com — a pretty clear tell that the domain is sitting on an auction block. bitwaddress.org took a stranger path: it picked up fresh NS records at ns306.parklogic.com and a brand-new MX at mail.eye-mail.net, alongside an SPF record that hard-fails everything except a single IPv6 /48 (v=spf1 ip6:fdec:ae16:fda7::/48 -all). That's a textbook "domain lapsed and got scooped up by a parking/monetization outfit" pattern — worth a second look if you ever held that name.

Quiet but real migrations

A handful of smaller moves tell their own stories:

  • kumag.ai dropped its Japanese DNS (ns1.dns.ne.jp) and Sakura-hosted mail/SPF setup for Porkbun's nameservers (curitiba.ns.porkbun.com and friends) and landed on AS16509 — a straightforward "moved the whole stack to a new registrar/host" migration.
  • legacybusinessbuyer.com left AWS's Route 53 nameservers and Outlook mail protection behind for launch1.spaceship.net / launch2.spaceship.net, hopping from AS24940 to AS16509 in the process.
  • attadigital.com and its www both picked up a sprawling 20-issuer CAA record (Amazon, DigiCert, Sectigo, GoDaddy, and more) while simultaneously moving its NS to InfinityFree's free hosting nameservers (ns1.byet.org, ns2.infinityfree.com, etc.) and jumping ASNs from AS24940 to AS34119 — an odd mix of "lock down who can issue certs" plus "move to free hosting."

gov.uk had a flicker

Our flapper detector caught gov.uk changing five times in the window. We don't have the specific record diffs here, but any repeated flapping on a domain that big is usually either a load-balanced DNS infrastructure doing its normal rotation — or worth keeping an eye on if it keeps happening.

That's the window — nothing dramatic, but a nice reminder that "boring" DNS changes are often just abandoned domains quietly changing hands.