CDS

CDS and CDNSKEY Automate DNSSEC Delegation Trust Updates

A DNSSEC-signed child zone can rotate its signing keys without changing the delegation immediately, but validators ultimately depend on the DS record set published by the parent. That parent-side state creates an operational handoff: a new key in the child does not become a secure delegation anchor merely because the child publishes it. CDS and CDNSKEY provide an in-band mechanism for that handoff. RFC 7344 defines records that a child can publish at its zone apex to signal prospective DS parameters. A parental agent can retrieve the signal, validate it under the applicable rules, apply local acceptance policy, and update the parent-side DS set.