October 28, 2026

Wix to TransIP, Shopify to Nowhere, and a CAA Tightening

Out of roughly 55,677 changes spotted across the ~41 million domains who.is watches in the last 24 hours, one quiet downgrade stands out more than any flashy migration: a site walking away from its CAA protections while also leaving a well-known platform behind.

The Shopify exit nobody announced

www.hrfae.com dropped its Shopify CNAME (shops.myshopify.com), moved off AS13335 onto AS16276, and in the process its hosting classification flipped from "cdn" to "unknown." More notably, its CAA records — which had restricted certificate issuance to digicert.com, globalsign.com, letsencrypt.org, pki.goog, and ssl.com — were removed entirely. No CAA record means any public CA can now issue a cert for that name. Combined with new nameservers at ns1.emailverification.info and ns2.emailverification.info, this looks like a full handoff away from Shopify's infrastructure — just without the usual safety rails reapplied on the other side.

Platform swaps worth watching

  • crew-b.com left Wix (ns0.wixdns.net / ns1.wixdns.net, AS58182) for TransIP nameservers (ns0.transip.net, ns1.transip.nl, ns2.transip.eu, AS205406), picked up Microsoft 365 mail routing (crewb-com01b.mail.protection.outlook.com), and added an SPF record pointing at spf.protection.outlook.com — a textbook "new host, new inbox" move.
  • maasi.net stayed inside the CDN world but changed brands, going from CDN77 to BunnyCDN while keeping AS60068 and AS200325 and adding AS212238.
  • mawnasmm.com jumped from free host InfinityFree (ns1.infinityfree.com and friends, AS34119) to ns20.namexen.com / ns21.namexen.com on AS150142 — and, like hrfae.com, shed a long CAA allowlist (Amazon, DigiCert, Let's Encrypt, Sectigo, and more) in the process.
  • www.visitfy.com and visitfy.com left NameBright's parking setup for Afternic nameservers (ns1.afternic.com, ns2.afternic.com) and now carry a locked-down v=spf1 -all — a classic sign of a domain heading for resale.

A SPF tightening worth noting

psn-international.net and its www counterpart rewrote their SPF record, swapping a ~all softfail for a build that explicitly whitelists more IPs (adding 65.98.12.160 and 65.98.12.164) while moving from AS204800 to AS25653 — mail infrastructure catching up with a network move.

The bigger picture

Today's window also logged about 360,000 freshly seen domains. Most of the day's churn, as usual, was mundane: ASN moves following hosting migrations (bbroot.com AS16509→AS154107, hseinternational.net AS174→AS270179, 69058.vip AS152194→AS4907) and routine NS swaps. But the CAA removals on hrfae.com and mawnasmm.com are the ones worth a second look if you're the kind of admin who actually checks what certificate authorities are allowed to mint for your domain.