Summary

  • ICANN’s current public-comment round reviews a June-dated security and stability assessment of DNSSEC DS automation; RFC 10026 became BCP 246 in July, and ICANN’s notice already lists it.
  • This review is followed by another public-comment proceeding on draft Standard Amendment Language. The “fast track” still has two public stops before the policy text is settled.

A fast lane with two comment windows is not much of a fast lane. It may still be the right route; first, someone has to check what the lane is built to carry.

ICANN opened its current comment proceeding on 12 October. It asks whether a 41-page assessment correctly identifies the security and stability issues around DNSSEC Delegation Signer (DS) automation, and whether its proposed mitigations are sufficient, proportionate and implementable. Comments close on 23 November; ICANN’s summary report is due on 7 December.

The mechanism under review is familiar to DNS operators. A child zone publishes CDS or CDNSKEY records to signal a DS change. The parent side—often a registry or registrar—checks the signal and updates the DS record in the parent zone. That can remove manual hand-offs from routine key rollovers. It can also put a broken trust chain into the DNS if a parent accepts an invalid signal, misses disagreement between authoritative servers, or fails to account for multiple signing operators.

The assessment separates its findings by force: seven hard requirements are preconditions for a positive security-and-stability finding; seven disclosure items must be documented, with design choices left to the operator; four recommended practices strengthen a deployment but are not required for a positive finding under the standards landscape the report describes. It also flags multi-signer handling, reporting and observability, and the signed-zone condition for nameserver bootstrapping.

Then there is the document clock. The assessment is dated 23 June 2026. In its text, draft-ietf-dnsop-ds-automation is still in IESG Evaluation and is described as a BCP that will become the operational reference once published. RFC Editor records RFC 10026—“Operational Recommendations for DNSSEC Delegation Signer (DS) Automation”—as published in July and assigned BCP 246. ICANN’s October notice cites RFC 10026 among the documents describing the method under review. The public notice is current; some future-tense sentences in the attached report are not.

That seam gives commenters a precise job: ask the addendum to say how the final RFC’s status and text affect the assessment’s draft-era references, and which parts remain ICANN’s own RSEP test. RFC 10026 states operational recommendations; ICANN’s assessment applies RSEP criteria to registry services.

The Board’s 14 September 2025 direction set up the Fast-Track Registry Services Evaluation Process for registry operators only if no security or stability issue is identified. ICANN says it will consider comments, update the assessment where appropriate, publish an addendum, and later open a separate proceeding on draft Standard Amendment Language. The current notice sets no date for that second round.

Read the primary records