[DNSOP] Re: Last Call: draft-ietf-dnsop-ds-automation-05 — audit continuity for automated DS decisions

[Peter Thomassen <[e-mail]>]

Hi Meir,

Thank you very much for your review!

On 4/24/26 21:17, Meir Goldman wrote:
> I support the direction of draft-ietf-dnsop-ds-automation. One operational gap worth tightening is audit continuity for automated DS decisions.
> The draft already recommends acceptance checks, cancellation when checks fail, notifications, and optional exposure of DS update history through customer portals. For operational safety, I suggest adding a short recommendation that parental agents retain structured decision records for automated DS maintenance, including failed or cancelled requests.
> Suggested addition to Section 5.1 or Section 9:
> Entities performing automated DS maintenance SHOULD retain structured records of DS automation decisions for a locally defined retention period. Records SHOULD include the child zone, triggering CDS/CDNSKEY RRsets or notification channel, authoritative nameserver set consulted, verification results, decision outcome, applied DS RRset or cancellation reason, timestamp, and the responsible parental agent. These records are intended to support troubleshooting, dispute resolution, and post-incident analysis, and need not be made publicly available.

This is a great suggestion. For context, the recommendation to make the DS history available earlier did not find consensus on the SHOULD level, as that would require major refactoring for certain registries. Everyone agreed that it's a reasonable/good thing to do, so it was included as a less binding recommendation.

Similarly, I'd expect there would not be consensus for including your proposal on SHOULD level. I've therefore added the following paragraph in Section 5.2, which describes the details on "Reports and Transparency":

NEW
    For troubleshooting, dispute resolution, and post-incident analysis,
    it is instrumental for the Parental Agent to retain structured
    records of DS automation decisions, including timestamp, triggering
    CDS/CDNSKEY RRsets, notification channel, authoritative nameservers
    consulted, verification results, decision outcome, and the applied DS
    RRset or cancellation reason.

https://github.com/desec-io/draft-ietf-dnsop-ds-automation/commit/c0925cd64e32dcd2924334567f200d220e7626e0

I hope this works for you -- in case it doesn't, please yell :) Preferably this week. Thanks!

Best,
Peter