What Are CDS and CDNSKEY?
Last updated
CDS (Child DS) and CDNSKEY (Child DNSKEY) are special DNS record types that facilitate the automated management of DNSSEC delegation. They enable child zones (your domain’s DNS) to signal their parent zones (typically registries like .com or .org) about changes in DNSSEC-related records, specifically the DS (Delegation Signer) record.
CDS and CDNSKEY records reduce the need for manual changes and help prevent issues that can make your domain unreachable. At DNSimple, these records are managed automatically, making DNSSEC easier and safer to use.
This automation significantly reduces the need for manual intervention during DNSSEC key rollovers or configuration updates. By automating this process, the risk of human errors, which can lead to critical DNSSEC validation failures and make your domain unreachable, is minimized.
Why are these records useful?
Without CDS or CDNSKEY, updating your DS records usually means doing everything by hand. You need to log in to your registrar’s dashboard, find the right settings, and copy long strings of DNSSEC data from your DNS provider to the registrar. It is not only a slow process, it is also easy to make mistakes.
If something goes wrong, like entering the wrong data or forgetting to update the DS record after a key change, your domain may stop resolving for people using DNSSEC-aware resolvers. Some users might still reach your site, but others will see errors, which can be confusing and damaging.
CDS and CDNSKEY help avoid this. They allow your DNS provider to tell the parent zone when a DNSSEC change happens, so the DS record can be updated automatically. This makes managing DNSSEC much safer and easier, especially during key rollovers or when enabling or disabling DNSSEC.
How does automation work?
If a parent zone supports CDS and/or CDNSKEY scanning:
- Your DNS provider publishes updated CDS and CDNSKEY records when keys change.
- The parent periodically scans for these records.
- Based on what it finds, the parent updates the DS records automatically.
This ensures your domain stays secure and resolvable during events like:
How DNSimple uses CDS and CDNSKEY
At DNSimple:
- CDS and CDNSKEY records are published automatically in every zone DNSimple signs, and updated each time the DNSSEC keys change, including during automatic key rotation.
- These records are managed by DNSimple. They’re system records, so you can’t add, edit, or delete them in the record editor.
- If your domain’s registry or registrar scans for CDS/CDNSKEY records, DS records at the parent will update automatically to reflect any DNSSEC changes made in DNSimple.
However, not all registries and registrars support this automation. In those cases, changes to your DNSSEC configuration may still require manual DS record updates at your registrar.
The role of DS records in DNSSEC validation
The DS record links the parent and child zones in DNSSEC. If a DS record exists in the parent zone but the corresponding DNSKEY is missing in the child zone, DNS resolvers will not be able to verify your domain. This often results in errors like SERVFAIL.
This mismatch can happen, for example, if DNSSEC is disabled in the child zone, but the DS record remains in the parent.
DNSimple doesn’t use CDS or CDNSKEY to remove DS records. When you disable DNSSEC, we remove the DS record at the registry for you if your domain is registered with DNSimple. If your domain is registered elsewhere, we email you to remove the DS record at your registrar.
Learn more
To learn more about DNSSEC, see What Is DNSSEC?. For a complete overview of DNSSEC at DNSimple, see DNS Security Extensions (DNSSEC) at DNSimple.
Have more questions?
If you have additional questions or need any assistance with DNSSEC, just contact support, and we will be happy to help. You can also read more about DNSimple Enterprise.