Skip to content
Control Plane Labs
Search

CDS record

Publishes the child zone's requested DS set so a parent or registrar can automate DNSSEC delegation maintenance.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

example.com. 3600 IN CDS 12345 13 2 4A8B...

Typical uses

  • Automating a DNSSEC key rollover from a child zone to its parent
  • Publishing a proposed DS set without giving a third-party DNS provider registrar credentials
  • Allowing a parent agent to discover the child's desired delegation state
  • Keeping the current DS set stable when a child publishes no valid change request

When it breaks, check

  • CDS records belong at the child zone apex and must be signed by a key already trusted by the parent
  • If both CDS and CDNSKEY are published, their resulting DS content must agree
  • An absent CDS or CDNSKEY set means no change; it is not an instruction to remove the current DS set
  • Do not use the mechanism as the sole proof for initial key enrollment or for moving a zone to unsigned

What the CDS record does

CDS carries the same fields as a DS record, but its meaning is “the DS set the child wants reflected at the parent.” The record is published at the child apex and should be signed by a key that is already represented by the current DNSKEY and DS sets. This lets a parent agent validate the request before changing the delegation. A parent may consume CDS, CDNSKEY, or both, but it must define its own default and acceptance policy.

The replace semantics matter during rollover: the complete requested set is the desired result, not a single additive instruction. Keep old keys long enough for DNS caches and signatures to age out. The DNS lookup tool can inspect the published record, while DS and DNSKEY explain the surrounding chain.

Zone-file and wire format

CDS uses the DS presentation format: key tag algorithm digest type digest. The key tag identifies the DNSKEY, algorithm identifies its signing algorithm, digest type identifies the DS digest, and the final field is hexadecimal digest data. A parent calculates or compares the corresponding DS set according to its DNSSEC policy; a child should not assume that a syntactically valid CDS will be accepted.

; illustrative DS-equivalent CDS record
example.com. 3600 IN CDS 12345 13 2 4a8b...sha256-digest...

Common uses

CDS is useful for registrar or parent automation during DNSSEC key changes. It keeps the desired delegation in the child zone and can reduce manual copy-and-paste errors. It does not replace ZONEMD integrity checks, authenticated transfers, or the parent account’s access controls. If the goal is mail policy, use DMARC and DKIM instead.

Troubleshooting

Verify the child apex first, then check that the CDS RRset is DNSSEC-valid and signed by a key present in both the current DNSKEY and DS sets. If CDNSKEY is also published, derive its DS result and compare the two complete sets. Check the parent agent’s chosen consumption type and its hold-down or polling rules; the RFC does not force every parent to process the record immediately.

If a rollover appears stuck, compare authoritative nameservers, SOA serials, RRSIG times, and TTLs. Do not remove an old DNSKEY or DS until the new delegation is published and the old data can no longer be served from caches.

dig example.com CDS +dnssec +noall +answer
dig example.com CDNSKEY +dnssec +noall +answer

# Query an authoritative child server directly.
dig @ns1.example.net example.com CDS +norecurse +dnssec +noall +answer

The defining RFC

CDS is DNS type 59 and is defined by RFC 7344, which specifies child-to-parent DNSSEC delegation maintenance. RFC 7344 requires the record at the child apex and says the request must be validated before a parent applies it. The IANA DNS Parameters registry assigns the type and shares DS registries for its fields.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types