ICANN seeks comment on security rules for automating DNSSEC DS records
in plain words
ICANN, the group that oversees internet names, wants feedback on rules for updating a key security link in domain names automatically. The link, called a DS record, helps prove that a domain is genuine. Wrong changes could make a website unreachable, so ICANN is asking the industry to review the safeguards.
Full summary
ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN has opened a public consultation on the security and stability requirements for automating the management of DNSSEC Domain Name System Security Extensions Digital signatures that prove DNS answers are genuine and unchanged. Full definition of DNSSEC Delegation Signer (DS record Delegation Signer A record in the parent zone that links a domain's DNSSEC key to the chain of trust. Full definition of DS record) records. The consultation opened on October 12, and comments are due by November 23, 2026, at 23:59 UTC. ICANN has scheduled its public comment An open period when anyone can comment on ICANN drafts. Full definition of public comment summary report for December 7, 2026.
DS records connect a signed domain to its parent zone, which lets validating resolver The DNS server that looks up domain names on behalf of users. Full definition of resolver check DNS Domain Name System The internet's directory that links domain names to computer addresses. Full definition of DNS responses. Keeping these records current can require coordination among DNS provider A company that runs the name servers for a domain, which may differ from the registrar. Full definition of DNS provider, registrar A company that registers domain names for customers with the registry. Full definition of registrar and registry The central database and system of a top-level domain, or loosely the organization that runs it. Full definition of registry, especially when cryptographic keys change or a DNS service provider is replaced. Automation could reduce that manual work, but incorrect or premature changes can break DNSSEC validation A resolver's check that a DNS answer is correctly signed with DNSSEC. Full definition of DNSSEC validation and make domains unreachable for users whose resolvers validate responses.
The review is meant to inform a Fast-Track Registry Services Evaluation Process (RSEP Registry Services Evaluation Policy ICANN's process for approving new or changed services at a gTLD registry. Full definition of RSEP) for DNSSEC CDS and CDNSKEY Child DS and Child DNSKEY Records a zone publishes so the registry can update its DNSSEC data automatically. Full definition of CDS and CDNSKEY. Under the proposed approach, qualifying registry operator The organization that holds the contract or mandate for a TLD and sets its rules. Full definition of registry operator could introduce automated DS management through a streamlined evaluation, subject to safeguards. The assessment was prepared with Interisle Consulting Group and covers automation mechanisms described in RFC Request for Comments A numbered document in the series recording the internet's technical standards and practices. Full definition of RFC 7344, 8078, 9615, 9975 and 10026.
The work follows a September 2025 decision by the ICANN Board ICANN's board of directors, which adopts policies and approves key decisions. Full definition of ICANN Board to adopt recommendations from its SSAC Security and Stability Advisory Committee ICANN's expert committee on security and stability of naming and addressing. Full definition of SSAC (SSAC). Those recommendations, published in SAC126, called for enabling automated DS record management while addressing operational and security risks.
ICANN is asking whether the review identifies security and stability concerns adequately, and whether the proposed requirements and recommendations are proportionate and practical. The consultation invites registry operators, DNS service providers and resolver operators to examine failure scenarios, including inconsistent DS updates, unsuccessful key rotations and the handling of authentication failures.
ICANN says a separate consultation will address implementation language, with draft standard amendment language for the fast-track process to be published in a later proceeding. After the current consultation closes, ICANN will review submissions, revise the assessment as appropriate and publish an addendum responding to the feedback.