Clarifications on CDS/CDNSKEY and CSYNC Consistency

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 16
Abstract: Maintenance of DNS delegations requires occasional changes of the DS and NS record sets on the parent side of the delegation. For the case of DS records, "Automating DNSSEC Delegation Trust Maintenance" (RFC 7344) provides automation by allowing the child to publish CDS and/or CDNSKEY records holding the prospective DS parameters that the parent can ingest. Similarly, "Child-to-Parent Synchronization in DNS" (RFC 7477) specifies CSYNC records to indicate a desired update of the delegation's NS (and glue) records. Parent-side entities (e.g., Registries and Registrars) can query these records from the child and, after validation, use them to update the parent-side Resource Record Sets (RRsets) of the delegation. This document specifies under which conditions the target states expressed via CDS/CDNSKEY and CSYNC records are considered "consistent". Parent-side entities accepting such records from the child have to ensure that update requests retrieved from different authoritative nameservers satisfy these consistency requirements before taking any action based on them. This document updates RFCs 7344 and 7477.
Publication Date: 2026-05-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9975
Link: https://doi.org/10.17487/RFC9975
Author(s): Peter Thomassen
Keyword(s): DNSSEC, DiffServ, Cinema Digital Sound, CDNSKEY, CSYNC, Automation

Latest version of IETF RFC 9975

Document Versions — IETF RFC 9975

▶ IETF RFC 9975 (2026-05-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 4033 [Active*]
IETF RFC 4034 [Active*]
IETF RFC 4035 [Active*]
IETF RFC 5730 [Active*]
IETF RFC 7344 [Active*]
IETF RFC 7477 [Active*]
IETF RFC 8078 [Active*]
IETF RFC 8174 [Active*]
RFC9364 — BCP237 EXTERNAL
IETF RFC 9615 [Active*]

Bibliographic Reference(s)

10.1145-3419394.3423623 — LAME1 EXTERNAL
10.1145-3487552.3487816 — LAME2 EXTERNAL
IETF.draft-ietf-dnsop-ds-automation-09 — I-D.ietf-dnsop-ds-automation EXTERNAL
IANA, "DNSSEC Delegation Signer (DS) Resource Record (RR) Type Digest Algorithms", <https://www.iana.org/assignments/ds-rr-types>. EXTERNAL
IETF RFC 6781 [Active*]
RFC8901 — RFC8901 EXTERNAL
IETF RFC 9499 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9975.json

Amends:

IETF RFC 7344 [Active*]

IETF RFC 7477 [Active*]

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9975, Clarifications on CDS/CDNSKEY and CSYNC Consistency. Available at https://doi.org/10.17487/RFC9975

Snippet:

IETF RFC 9975, Clarifications on CDS/CDNSKEY and CSYNC Consistency. Available at https://doi.org/10.17487/RFC9975

HTML (ISO 690 compliant)

Preview:

IETF RFC 9975, Clarifications on CDS/CDNSKEY and CSYNC Consistency. Available at https://doi.org/10.17487/RFC9975

Snippet:

<span class="citation"><cite>IETF RFC 9975</cite>, Clarifications on CDS/CDNSKEY and CSYNC Consistency. Available at <a href="https://doi.org/10.17487/RFC9975" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9975</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9975, Clarifications on CDS/CDNSKEY and CSYNC Consistency
doi: 10.17487/RFC9975
url: https://doi.org/10.17487/RFC9975

Snippet:

<li>
<cite id="bib-rfc9975">IETF RFC 9975</cite>, Clarifications on CDS/CDNSKEY and CSYNC Consistency
<span class="doi">10.17487/RFC9975</span>
</li>