Automating DNSSEC key management could simplify registry operations, but failed updates risk disrupting domain resolution. ICANN is seeking industry input on proposed safeguards.

ICANN has opened a public consultation on the security and stability requirements for automating DNSSEC Delegation Signer (DS) record management, a step toward simplifying how domain registries maintain the cryptographic links that underpin DNSSEC validation. The consultation opened October 12, with comments accepted through November 23, 2026.

The assessment could establish a faster approval process for registries. ICANN is seeking feedback on a security and stability review that will inform a Fast-Track Registry Services Evaluation Process (RSEP) for DNSSEC DS automation. The proposed approach would allow qualifying registry operators to introduce automated DS record management through a streamlined evaluation process, subject to appropriate safeguards.

The review follows a September 2025 decision by the ICANN Board to adopt recommendations from its Security and Stability Advisory Committee (SSAC). Those recommendations, published in SAC126, called for facilitating automated DS record management while addressing potential operational and security risks.

DS records are essential to DNSSEC’s chain of trust. They connect a signed domain to its parent zone, allowing validating resolvers to authenticate DNS responses. Maintaining these records can require coordination among DNS operators, registrars and registries, particularly when cryptographic keys change or DNS service providers are replaced.

Automation can reduce the manual coordination involved in these operations. Incorrect or premature DS record changes, however, can break DNSSEC validation and make otherwise operational domains inaccessible to users relying on validating resolvers.

ICANN is examining whether the proposed safeguards are sufficient. The assessment, prepared with Interisle Consulting Group, covers automation mechanisms described in RFCs 7344, 8078, 9615, 9975 and 10026. ICANN is asking whether the review adequately identifies security and stability concerns and whether its proposed requirements and recommendations are proportionate and practical to implement.

The consultation provides an opportunity for registry operators, DNS service providers and resolver operators to examine operational failure scenarios, including inconsistent DS updates, unsuccessful key rotations and the handling of authentication failures. Such scenarios are relevant to evaluating whether automated changes can be introduced without compromising DNSSEC validation.

A separate consultation will address implementation language. ICANN plans to publish draft standard amendment language for the fast-track process in a subsequent proceeding. Following the current consultation, it will review submissions, make appropriate revisions to the assessment and publish an addendum addressing the feedback received.

Comments close at 23:59 UTC on November 23. ICANN has scheduled its public comment summary report for December 7, 2026.