CDS/CDNSKEY record
CDS and CDNSKEY records, defined in RFC 7344, let a DNSSEC-signed domain automate updating the DS record its parent zone publishes, instead of relying on a human to copy a new key fingerprint into a registrar's control panel by hand. A domain's own DNS operator -- the "child" side of the delegation -- publishes a CDS (Child DS) or CDNSKEY (Child DNSKEY) record in its own zone, stating exactly what it wants the parent zone's DS record to contain. A registry or registrar that supports RFC 7344, acting as the "parental agent," periodically polls the child zone for these records and, once it finds a validly signed CDS or CDNSKEY, updates the actual DS record at the parent automatically, with no manual registrar-panel step required. This closes one of DNSSEC's most common operational failure modes: a key rollover where the domain's own DNSKEY changes but the parent zone's DS record is never updated to match, breaking validation for every resolver checking that chain until someone notices and fixes the mismatch by hand.
By AdminKit team, Netbase JSC · Updated