Child-to-Parent Synchronization in DNS
Extracted elements (27)
The CSYNC record's child-to-parent signaling model was chosen to ease the burden on child zone operators who struggle to keep delegation records (NS, A, AAAA glue) in sync with the parent, a problem caused by operator complexity and the lack of an automated update mechanism.
This specification explicitly does not address DNSSEC security record synchronization (DS, DNSKEY) and does not cover bootstrapping of the initial DNSSEC-secured environment. These concerns are delegated to the complementary RFC 7344, which maintains security delegation information.
For out-of-bailiwick NS records (where the NS target is outside the child zone), the parent will only update glue records that fall below the child's delegation point; glue for grandchild zones cannot be safely updated by the parent via CSYNC.
The Type Bit Map field presentation format must use the TYPE representation from RFC 3597 Section 5 when the mnemonic is not known. Implementations supporting presentation format parsing SHOULD be able to read and understand these TYPE representations.
Child DNS operators wanting a parental agent to perform synchronization MUST publish a CSYNC record at the apex of the child zone.
DNS over TCP SHOULD be used when processing a CSYNC transaction to avoid conversing with multiple nodes at an anycast address, ensuring all queries go to a single authoritative name server.
If a bit in the Type Bit Map has been set that a parental agent does not understand, the parental agent MUST NOT act upon the record; it must not simply copy the data but must understand the semantics of any set bit.
If SOA serial numbers from the first, middle, and last steps of the processing procedure differ, the CSYNC record SHOULD NOT be processed. If the soaminimum flag is set and the SOA serial is less than the CSYNC record's SOA Serial field, the record MUST NOT be processed.
If the 'immediate' flag is not set, the parental agent MUST NOT act until the zone administrator approves the operation through an out-of-band mechanism.
If the result of processing A/AAAA glue records would leave no in-bailiwick A or AAAA records when there are in-bailiwick NS records, the parent MUST NOT update the glue address records.
Parental agents MUST ignore a child's CSYNC RDATA set if multiple CSYNC resource records are found; only a single CSYNC record should ever be present.
Parental agents MUST NOT perform NS updates if there are no NS records returned in a query as verified by DNSSEC denial-of-existence protection.
Parental agents MUST process the entire set of child data indicated by the Type Bit Map field, or else MUST NOT make any changes to parental records at all. Errors due to unsupported Type Bit Map bits SHALL result in no change to the parent zone's delegation information.
Parental agents that support CSYNC processing SHOULD publicly document their processing characteristics, including supported Type Bit Map bits, polling frequency, 'immediate' flag support, nameserver querying strategy, SOA serial caching, and error reporting locations.
The parental agent MUST perform DNSSEC validation of the CSYNC RRType data and MUST perform DNSSEC validation of any data to be copied from the child to the parent. Parents MUST NOT process any data if any validation result is other than 'Secure' or if required data cannot be retrieved.
The procedure for querying A and AAAA records MUST occur after the procedure for querying NS records (if required), to ensure the correct current NS set is used.
The processing of CSYNC records must be treated as an 'all or nothing' operation: if a parental agent fails to successfully query for any required record, the whole operation MUST be aborted.
Undefined flags in the Flags field MUST be set to 0 by CSYNC publishers. Parental agents MUST NOT process a CSYNC record if it contains a 1 value for a flag that is unknown to or unsupported by the parental agent.
The CSYNC RRType is a new DNS resource record published at the apex of a child zone. Its RDATA contains a 32-bit SOA serial number, a 16-bit Flags field, and a Type Bit Map indicating which delegation record types (e.g., NS, A, AAAA) the parental agent should copy from the child zone to the parent.
The Flags field is 16 bits and currently defines two flags: bit 0 ('immediate', value 0x0001) signals the parental agent to process the CSYNC record without out-of-band approval, and bit 1 ('soaminimum', value 0x0002) requires the queried zone's SOA serial to be greater than or equal to the value in the SOA Serial field.
The SOA Serial field in the CSYNC record is a 32-bit copy of the child zone's SOA serial number. When the soaminimum flag is set, parental agents MUST NOT act on data from zones with a SOA serial less than this value; if the flag is unset, the field MUST be ignored.
IANA assigned DNS RR TYPE code 62 to the new 'CSYNC' resource record type in the 'Resource Record (RR) TYPEs' sub-registry of the 'Domain Name System (DNS) Parameters' registry.
IANA created a new 'Child Synchronization (CSYNC) Flags' sub-registry under 'Domain Name System (DNS) Parameters'. It holds 16 single-bit flags; new assignments require Standards Action. Initial entries are bit 0 ('immediate') and bit 1 ('soaminimum').
CSYNC processing MUST NOT be used to synchronize DS records, DNSKEY materials, CDS records, CDNSKEY records, or CSYNC records themselves. All DNS transactions must be validated by DNSSEC as 'secure'. Child zones deploying CSYNC MUST be signed and properly linked to the parent with a DS record.
To prevent replay attacks on older CSYNC records using the soaminimum flag, the SOA serial number MUST NOT be incremented by more than 2^16 during the lifetime of the signature window of the RRSIGs signing the SOA and CSYNC records.
The CSYNC processing procedure defines four sequential steps: (1) query child zone's SOA, (2) query child zone's CSYNC record, (3) query data records per Type Bit Map, (4) re-query SOA records. If SOA serials differ between steps, the operation is aborted; if they match and pass soaminimum checks, records are updated in the parent zone.
The CSYNC RDATA wire format consists of: a 32-bit SOA Serial field, a 16-bit Flags field, and a variable-length Type Bit Map field encoded identically to the NSEC record's Type Bit Map (as defined in RFC 4034 Section 4.1.2).