October 7, 2026

gov.uk flaps, woodforest.com loads up on TXT records

Out of roughly 89,603 changes seen across about 35 million tracked domains in the last day, nothing beats a government domain glitching and a bank's DNS record turning into a TXT-record junk drawer. Here's what stood out.

gov.uk can't sit still

Our flapper list flags gov.uk with 5 changes in the window — more than anything else we tracked. We don't have the specific record diffs for it in today's facts, but repeated flipping on a domain that size (DNSSEC, load balancing, or just routine infra churn) is the kind of thing worth watching rather than panicking over.

woodforest.com's TXT record gets crowded

woodforest.com (now fronted by Cloudflare, AS13335) added a CAA record restricting issuance to godaddy.com, pki.goog, and digicert.com, plus new MX entries (mail01.woodforest.com, mail02.woodforest.com). But the real story is the TXT record pile-up: Microsoft (MS=), Google site verification, a Duo SSO verification, a Cisco Intersight key, and a long SPF string covering a dozen-plus IP ranges all landed at once. That's a classic sign of an org onboarding several SaaS/security tools in one sweep rather than anything malicious.

Quiet migrations onto Cloudflare

A handful of domains swapped their old nameservers for Cloudflare's this window:

  • elenavogt.com / www.elenavogt.com dropped suspended sawbuck.com nameservers (AS2635) for annalise.ns.cloudflare.com and damiete.ns.cloudflare.com.
  • betsandships.com left NS1 (dns1-4.p02.nsone.net, AS14618) for Cloudflare's brodie/cecelia nameservers.
  • yayed.org moved off AS219502 and onto Cloudflare, swapping its CNAME from a 2026cname.com target to url.gname.net.

Meanwhile papirfly.com went the other way, leaving Cloudflare for AS12996 — a reminder that CDN churn runs in both directions.

Cleanup and takeovers

Several domains show the fingerprints of expiring registrations or recovered abuse cases: akhvac-llc.com swapped renewyourname.net nameservers for ns1/ns2.dns-redirect.com and picked up fresh CAA entries plus an afternic-verification TXT — a parked-domain pattern. comgb.com did something similar, landing on parkingcrew.net nameservers with a new SPF record pointing at an IPv6 /48. And halinker.com dropped Microsoft 365 mail (halinker-com.mail.protection.outlook.com) and hostied.net NS records for Spaceship's launch1/launch2.spaceship.net — a domain-registrar consolidation move, not a hosting one.