Summary

  • ICANN opened public comment on 12 October on Interisle Consulting Group’s security and stability assessment of automating DNSSEC delegation-signer records.
  • Interisle says the mechanism raises no significant issue under the relevant definitions only if seven hard requirements are met and operators document seven specified disclosures.
  • The comment process is an evidence gate, not deployment approval: ICANN org must still make its own determination, and draft Fast Track contract language is promised in a later proceeding.

The board’s instruction came first, with a condition attached. In September 2025, the ICANN Board accepted SSAC advice and directed ICANN org to establish a Fast Track Registry Services Evaluation Policy route for registry operators only if the organization identifies no security or stability issue. The same resolution says registrars may deploy the service without ICANN approval. A year later, the organization has put an external assessment out for comment rather than announcing that the condition has been met.

The assessment, dated 23 June and prepared by Interisle Consulting Group, studies a narrow handoff. A child-zone operator publishes signed CDS or CDNSKEY records. A parent registry or sponsoring registrar can retrieve and validate them; the registry alone publishes the resulting DS record in the parent zone. Registrants retain ultimate authority over their DNSSEC configuration, while operators, registrars and registries control different steps in the route.

That separation matters because a DS record connects a child zone’s key to the parent’s chain of trust. Automation can remove manual delay, but it also turns a child-side signal into a change at another organization’s zone. Interisle assesses routine DS maintenance, initial provisioning and the transition to an insecure delegation. It does not cover push APIs, out-of-band interfaces or CSYNC.

Interisle divides its 18 findings by force. Seven are hard requirements: validate the proposed DS at the parent; keep authoritative nameservers consistent; let a registrar opt out; do not suspend ordinary maintenance solely because clientUpdateProhibited is set; preserve a manual DS-management route; process an authenticated algorithm-zero signal correctly when going insecure; and notify the registrar when registry-led automation uses EPP. Seven more items disclose operator choices such as polling cadence, latency, TTL and rollback windows, extra checks, multi-signer handling and reporting channels. Four recommendations go beyond that minimum, including drift reporting and shorter DS TTLs.

Interisle’s conclusion is therefore conditional, not a certificate for every implementation. It says the mechanism does not raise significant security or stability issues under the RSEP definitions when the hard requirements are satisfied and the disclosures are documented. It also identifies unresolved attention points: multi-signer deployments, observability and the signed-nameserver precondition for one bootstrapping path.

ICANN’s proceeding asks whether the assessment identifies the relevant issues and whether its mitigations are sufficient, proportionate and implementable. Submissions close on 23 November 2026; the summary report is due on 7 December. ICANN says it will consider changes, publish an addendum explaining its review, and bring proposed Standard Amendment Language for the Fast Track to a later public proceeding. Until then, the Board’s conditional direction, the consultant’s finding, ICANN org’s determination, contract language and an operator’s deployment remain separate states.

Sources