Flipkart drops its CAA fence, and a domain gets a full reset

Out of roughly 5.5 million tracked domains, DNS watchers logged 3,937 changes in the last 24 hours. Most are the usual SOA serial bumps and nameserver housekeeping, but a few stood out.

Flipkart loosens its certificate guardrails

www.flipkart.com, sitting on Akamai's CDN, had its CAA records pulled — the ones authorizing digicert.com, globalsign.com, and letsencrypt.org to issue certificates for the domain (plus a wildcard entry for globalsign.com). At the same time it dropped its Mimecast inbound MX records (eu-smtp-inbound-1.mimecast.com, eu-smtp-inbound-2.mimecast.com). CAA records are a lock on who's allowed to mint TLS certs for you — removing them doesn't open a hole by itself, but it does widen the field of CAs that could theoretically issue for the name. Combined with the Mimecast MX removal, it reads like a broader mail/cert infrastructure cleanup rather than anything malicious, but it's exactly the kind of quiet config change worth keeping an eye on for a domain that big.

rhythmi.ir gets torn down and rebuilt

Few changes in the window were as thorough as what happened to rhythmi.ir (and its www counterpart). In one shot, the domain moved from AS49505 to AS34119, dropped its CNAME, MX, and NS records tied to routedns.net, ditched its SPF record, and picked up a brand-new CAA policy explicitly listing 19 different certificate authorities — Amazon, DigiCert, Let's Encrypt, Sectigo, Google's pki.goog, and more. That's not a typical config tweak; it's the DNS footprint of a domain being handed to a new owner or platform and rebuilt from scratch.

A parking-service pattern

Two unrelated domains, mediacomm.co.id and www.iphix.us, followed a strikingly similar path today: both dropped their old nameservers in favor of dns-parking.com servers (byte/pixel for one, aurora/nebula for the other), and both picked up Hostinger mail records (mx1.hostinger.com, mx2.hostinger.com) along with Hostinger's SPF include. mediacomm.co.id also lost its Wix nameservers (ns14/15.wixdns.net) and Google MX in the process. Seeing two independent domains land on the same parking infrastructure with the same mail provider in one day is a small but neat signal of a registrar or reseller batch-migrating customers.

Everyone's switching ASNs today

The provider-migration list was busy with straightforward ASN hops: 1001a.com jumped AS4134 → AS4811, zhushan.cc went AS4811 → AS140979, www.viofbk.vip moved AS8075 → AS132825, and a cluster of .us numeric domains (02718.us, 04552.us, 01090.us) bounced between AS14618 and AS16509. On their own these are just hosting moves, but the sheer number of same-day network changes across otherwise unrelated domains is a reminder of how much background reshuffling happens on any given Tuesday.