---
id: "05a14eb6-328c-41d5-8ab2-3982ec70a0fb"
kind: "link"
title: "ICANN seeks comment on security rules for automating DNSSEC DS records"
language: "en"
section: "icann"
date: "2026-10-14T05:40:54Z"
updated: "2026-10-14T05:40:54Z"
canonical: "https://tldlog.com/l/icann-seeks-comment-security-rules-automating-dnssec-ds/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/icann-pide-comentarios-normas-seguridad-automatizar/"
  de: "https://tldlog.com/de/l/icann-bittet-kommentare-sicherheitsregeln-automatisierung/"
  it: "https://tldlog.com/it/l/icann-chiede-pareri-regole-sicurezza-automatizzare-record-ds/"
  pt-BR: "https://tldlog.com/pt/l/icann-busca-comentarios-regras-seguranca-automatizar/"
  zh-Hans: "https://tldlog.com/zh/l/icann-zhengqiu-dnssec-ds-zidonghua/"
source:
  name: "circleid.com"
  url: "https://circleid.com/posts/icann-opens-consultation-on-security-requirements-for-dnssec-ds-automation"
  language: "en"
  date: "2026-10-13T17:29:00Z"
---

# ICANN seeks comment on security rules for automating DNSSEC DS records

## in plain words

ICANN, the group that oversees internet names, wants feedback on rules for updating a key security link in domain names automatically. The link, called a DS record, helps prove that a domain is genuine. Wrong changes could make a website unreachable, so ICANN is asking the industry to review the safeguards.

ICANN has opened a public consultation on the security and stability requirements for automating the management of DNSSEC Delegation Signer (DS) records. The consultation opened on October 12, and comments are due by November 23, 2026, at 23:59 UTC. ICANN has scheduled its public comment summary report for December 7, 2026.

DS records connect a signed domain to its parent zone, which lets validating resolvers check DNS responses. Keeping these records current can require coordination among DNS operators, registrars and registries, especially when cryptographic keys change or a DNS service provider is replaced. Automation could reduce that manual work, but incorrect or premature changes can break DNSSEC validation and make domains unreachable for users whose resolvers validate responses.

The review is meant to inform a Fast-Track Registry Services Evaluation Process (RSEP) for DNSSEC DS automation. Under the proposed approach, qualifying registry operators could introduce automated DS management through a streamlined evaluation, subject to safeguards. The assessment was prepared with Interisle Consulting Group and covers automation mechanisms described in RFCs 7344, 8078, 9615, 9975 and 10026.

The work follows a September 2025 decision by the ICANN Board to adopt recommendations from its Security and Stability Advisory Committee (SSAC). Those recommendations, published in SAC126, called for enabling automated DS record management while addressing operational and security risks.

ICANN is asking whether the review identifies security and stability concerns adequately, and whether the proposed requirements and recommendations are proportionate and practical. The consultation invites registry operators, DNS service providers and resolver operators to examine failure scenarios, including inconsistent DS updates, unsuccessful key rotations and the handling of authentication failures.

ICANN says a separate consultation will address implementation language, with draft standard amendment language for the fast-track process to be published in a later proceeding. After the current consultation closes, ICANN will review submissions, revise the assessment as appropriate and publish an addendum responding to the feedback.

Source: [circleid.com](https://circleid.com/posts/icann-opens-consultation-on-security-requirements-for-dnssec-ds-automation)