October 29, 2026

A nonprofit's mail moves in with a rescue mission

Across the roughly 41 million domains we watch, today's window logged 56,647 changes and about 360,000 brand-new domains. Most of it is routine churn, but a few records tell real stories once you read between the lines.

A .org's inbox moves in with a rescue mission

www.missionuniversity.org dropped Cloudflare's nameservers (brad.ns.cloudflare.com, leah.ns.cloudflare.com) in favor of ns2.integrationworks.com, and its network home shifted from AS14567 to AS396982. The interesting part is mail: five new MX records now point to smtp.integrationworks.com, smtp2.integrationworks.com, and three hosts at rescuemission.org (smtp.rescuemission.org, smtp2.rescuemission.org, mail.rescuemission.org). New TXT records bring in a Duo SSO verification string and an SPF record that still authorizes Mandrill (spf.mandrillapp.com) and secure.giftlegacy.com. Put together, it looks like missionuniversity.org's email infrastructure is now sharing a roof with rescuemission.org — the kind of DNS fingerprint you'd expect from an affiliation or back-office merger between two mission-driven organizations.

Shopify loses a Brazilian storefront

www.maionesetcg.com.br quietly swapped e-commerce platforms: its CNAME moved from shops.myshopify.com to maionesetcg.lojavirtualnuvem.com.br, and the hosting network flipped from Shopify (AS13335) to AS273584. The CAA records that used to restrict certs to digicert.com, globalsign.com, letsencrypt.org, pki.goog, and ssl.com were removed in the same pass — a telltale "we migrated and rebuilt everything from scratch" signature.

Loosening (and locking) the certificate rules

CAA records are supposed to say "only these CAs may issue certs for us," so changes there are always worth a glance:

  • musik-24.net stripped out a long CAA allow-list that had named Amazon, GlobalSign, DigiCert, Sectigo, GoDaddy, and more — the domain now has no CAA restrictions at all.
  • www.waslamarket.net removed its CAA rules too, but alongside that it dropped its Vercel CNAME (0f0c0faf0b9121bd.vercel-dns-017.com), picked up Afternic parking nameservers, and added a hard v=spf1 -all — classic signs of a site going dark and being parked for resale.
  • ataxia.su, still sitting on Cloudflare, simply updated its CAA incident-reporting contact from ssl-reports@aedliz.space to ssl-reports@elyrion.tech — a vendor rebrand rather than a security problem.
  • milkyray.com left Akamai's CDN for AS63949 and picked up its first-ever CAA record for letsencrypt.org while reordering its MX priority — someone's clearly standardizing TLS issuance after the move.

Same AS, same minute

Sometimes the data hands you a coincidence that's really a pattern: secretstorms.com and janhenderson.com both jumped from AS31898 to AS46606, both flipping from "unknown" to "direct" hosting, just 14 seconds apart. Unrelated domain names, identical network move, same breath — almost certainly one operator running a scripted migration across a batch of properties rather than two unlucky coincidences.