DNS Watch: A Cloudflare Exit, a Lapsed Domain, and Tightened SPFs

Roughly 43,685 changes rippled across the domains who.is watches in the last 24 hours, out of about 32 million tracked and around 430,000 new registrations. Most of it is routine — MX swaps, SPF tweaks — but a few changes tell real stories.

Leaving Cloudflare, not joining it

www.tre0d.top did the unusual thing: it moved off Cloudflare (AS13335 / AS135074) and landed on AS174, with its hosting classification flipping from "Cloudflare (cdn)" to "unknown." Most of the traffic we see is domains joining Cloudflare — ozelyem.com is a good example of the more common direction, switching from a plain AS36351 setup onto Cloudflare's network while also swapping its mail routing to gw.tsoft.biz and rewriting its SPF record to match.

Meanwhile dudugontijo.com cut ties with its Brazilian host entirely — dropping ns1/ns2.ssd1br.com.br and a long SPF record full of ssd1br.com.br IPs, in favor of Network Solutions' dns1-5.name-services.com and a move to AS16509. That's a full-stack migration: nameservers, mail, and network all changing hands at once.

A domain that just... stopped

akx-group.com is the more cautionary story. In one shot it lost its CAA policy, its trendycorp.fr nameservers, its MX records, and its SPF include — replaced by a TXT record that simply says "expired." Registration lapses like this are a reminder that DNS records don't fade gracefully; they get pulled all at once when the lights go out.

atletasdebaleares.com (and its www) landed somewhere similar but softer — losing its CAA restriction and trafficveil.com nameservers in favor of abovedomains.com parking infrastructure and a park-mx.above.com mail sink. Classic signs of a domain sliding into parked/for-sale limbo.

Security records worth a second look

A few domains tightened things up today:

innokar.com added a CAA record with an iodef contact and, notably, hardened its SPF policy from a soft ~all to a strict -all — meaning mail servers should now hard-fail on unauthorized senders instead of just flagging them.
msme.gov.in swapped its CAA issuer from Let's Encrypt to GlobalSign and added a matching domain-verification TXT record — the kind of change you'd expect ahead of a certificate provider switch on a government domain.
www.spxflow.biz, sitting behind Imperva, added CAA entries for both DigiCert and GlobalSign, keeping its certificate issuance options open rather than locked to one CA.

The odd couple

Two unrelated-looking domains, gougou15.top and animekageonline.com, both swapped their nameservers to ns1/ns2.koaladns.com and landed on the same network, AS395954, within minutes of each other. Coincidence, or two properties riding the same infrastructure churn — either way, it's the kind of synchronized move worth keeping an eye on.