https://nalar.dev/tags/cds/ Recent content in CDS on Nalar Hugo en-us Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/cds-and-cdnskey-automate-dnssec-delegation-trust-updates/ Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/cds-and-cdnskey-automate-dnssec-delegation-trust-updates/ <p>A DNSSEC-signed child zone can rotate its signing keys without changing the delegation immediately, but validators ultimately depend on the DS record set published by the parent. That parent-side state creates an operational handoff: a new key in the child does not become a secure delegation anchor merely because the child publishes it.</p> <p>CDS and CDNSKEY provide an in-band mechanism for that handoff. RFC 7344 defines records that a child can publish at its zone apex to signal prospective DS parameters. A parental agent can retrieve the signal, validate it under the applicable rules, apply local acceptance policy, and update the parent-side DS set.</p>