A DNS change can involve a hosting company, a registrar and a registry. When they all need to agree on the information used to validate a domain, a manual hand-off can become a source of mistakes.
ICANN announced a public consultation on 13 October 2026 about the security and stability of automating DNSSEC Delegation Signer, or DS, records. Submissions opened on 12 October and close on 23 November at 23:59 UTC.
Why the DS record matters
DNSSEC provides a way to check the authenticity of signed DNS data. The DS record published by a parent zone connects that trust to the signing keys used by the child zone.
When the relevant signing key changes, the information at the parent needs to remain consistent with the child. RFC 7344 describes the manual maintenance problem and a way to automate subsequent DS updates using information published in DNS.
A mismatch can break validation, leaving a working website or mail service difficult to reach through validating resolvers. That is why the update process deserves attention alongside ordinary record changes.
The consultation concerns safe implementation
ICANN's consultation page asks whether the assessment identifies the relevant security and stability issues, and whether its requirements and recommendations are sufficient and practical. The work supports a proposed fast-track evaluation process for registry services.
For a hosting team, this is a useful point to review the capabilities already offered by its DNS providers and registrars. Ask which mechanisms they support and which parts of a key change remain manual.
Know who controls each step
Start with a representative customer domain. Record who signs its DNS zone, who manages the registrar account and who can arrange a DS update at the parent.
Those roles can belong to different businesses. A client may control the registration while an agency controls the hosting and a separate provider operates DNS.
Make the responsibilities clear before changing providers or signing keys. The person arranging the work needs a route to every relevant administrator, with the access and authority to complete their part.
Ask how an automated update is authenticated, how long it normally takes and where its result is recorded. A dashboard saying automation is enabled should come with a way to confirm what actually happened.
Include validation in the change checks
Our suggested maintenance check is to test the domain through a validating resolver after the change, then review the provider's update result. Keep the time, records and relevant identifiers with the change ticket.
Also agree how the team will respond if validation fails. Confirm the provider's recovery procedure and contact route before the maintenance window, particularly when the registrar account belongs to a customer.
If your organisation operates a relevant DNS service, review the assessment and submit practical feedback through ICANN's official process. Describe the operational issue and the evidence behind it.
Automation can reduce a repetitive hand-off. The useful outcome is an update process whose ownership, authentication and result your team can explain when a customer asks why their domain stopped resolving.
Reporting checked on 13 October 2026. Operational checks are our assessment; the consultation does not establish provider-wide deployment.
