We have been quietly tightening things up behind the scenes. Nothing dramatic, no breaches, no incidents - just a bunch of small decisions we made as the platform started getting more real traffic (and real abuse attempts).
Here is what changed and why.
MX and NS records are now restricted
We originally opened up most DNS record types because, well, why not. Turns out why not is that MX and NS records are a magnet for abuse - spam relays, phishing setups, and domain hijacking attempts showed up pretty quickly once the service got any traction. Both types now require approval before you can add them. A records, CNAMEs, AAAAs, TXT - all still open as usual.
Email passthrough accounts removed
We had some catch-all email routing set up for the localnode.app domain that was originally there for convenience. It became a vector for spam and forged sender abuse, so we pulled it. Outbound notification emails still work fine - this only affected incoming routing that nobody was legitimately using anyway.
Proper support form
The old support path was basically a mailto link. Now there is an actual support form that creates a tracked ticket, so nothing gets lost in an inbox. If you have sent us something in the past and not heard back, sorry - please resubmit through the new form.
Bot protection on the API
The site started getting hammered by bots - credential stuffing, subdomain enumeration, that kind of thing. We enabled Cloudflare bot protection across the domain. The DDNS endpoint has a WAF bypass so legitimate clients still work, but generic scanners now get a hard stop at the edge.
Updated terms and privacy policy
Both documents have been rewritten to actually reflect how the service works today rather than the boilerplate we launched with. Nothing surprising in there - no selling data, no ads, free tier stays free. Worth a read if you care about that stuff.
If anything here affects you or you have questions, the support form is the best place to reach us.