Parked Domains Flee, AWS Grabs Certs, and gov.uk Can't Sit Still

Out of roughly 35 million tracked domains, we saw 66,979 changes and about 530,000 new domains show up in this 24-hour window. Most of it is routine SPF housekeeping and nameserver shuffling — but a few patterns stood out.

The Parking Crew exodus

Three unrelated-looking domains — day.info, aismutwiter.com, and chalkboardtable.com — all shared the exact same starting point: NS records on ns1.parkingcrew.net / ns2.parkingcrew.net, MX pointed at mail.h-email.net, a CAA record authorizing letsencrypt.org, and the same oddly specific SPF line (v=spf1 ip6:fd1b:212c:a5f9::/48 -all). All three dropped that setup within minutes of each other, moving to different new homes — day.info landed on AS16509, aismutwiter.com went to changchang.ns.giantpanda.com on AS63949, and chalkboardtable.com picked up a Google site-verification TXT and moved onto Cloudflare. Looks like a batch of parked domains got reassigned or sold out of the same parking inventory on the same day.

Elsewhere, flowlaunder.com dropped its registrar.com email-forwarding setup (eforward1-5.registrar-servers.com) entirely and switched to Cloudflare nameservers, while missourinearme.com left a custom DNS provider (ns1-4.lgmdns.com, AS48254) for Cloudflare too — two more small sites consolidating onto Cloudflare's edge.

Amazon's cert footprint

headofzeus.com and westelm.com (sitting on Akamai) both added a CAA record authorizing amazonaws.com to issue certificates for them. CAA additions like this usually mean a workload or endpoint is moving behind AWS-issued TLS — worth watching if you depend on either domain's cert chain.

A domain that couldn't make up its mind

hetai-zipper.com had a wild few minutes: it added a full CAA policy (Comodo, DigiCert, GlobalSign, Let's Encrypt, Google, SSL.com) plus Cloudflare nameservers and a Zoho/SPF setup — then almost immediately reversed nearly all of it, swapping to a different Cloudflare NS pair, dropping the CAA records, and moving off Cloudflare to AS25052 and then AS16276. That's a lot of config churn for one domain in one day.

Housekeeping and flappers

Spain's seg-social.es quietly scrubbed a long list of legacy TXT verification records (old Apple, Cisco, Google, and internal tracking tokens) — a sign someone finally cleaned up years of accumulated DNS clutter. And gov.uk logged 4 changes in the window, making it today's most active "flapper" — nothing alarming in the data, but enough wobble to catch our attention.