3. Requisiti di elaborazione

Before acting on any CDS/CDNSKEY or CSYNC record, a Parental Agent MUST fetch all IP addresses for each nameserver hostname listed in the Child's delegation from the Parent, using a validating resolver and including available glue records. It MUST establish plausible consistency by querying all these IP addresses for the relevant RRsets. Consistency is REQUIRED across received responses only, and NODATA is a received response.

If a response cannot be obtained, the Parental Agent SHOULD retry later before concluding that the nameserver is permanently unreachable. A configurable retry schedule is RECOMMENDED, and exponential back-off is suggested. The Parental Agent MAY also query from another network vantage point. If an inconsistent state is encountered, the Parental Agent MUST abort the operation and MUST NOT delete, alter, or create any RRset that would have changed if responses had been consistent. DNSSEC signatures MUST be requested and validated for all queries unless otherwise noted.

3.1. CDS and CDNSKEY

For CDS/CDNSKEY, the Parental Agent MUST query all nameservers listed in the Child's delegation from the Parent. Each key referenced in any received answer must also be referenced in all other received responses, subject to CDS digest type rules, or responses must consistently request removal of the entire DS RRset [RFC8078]. If a key appears in CDS but not CDNSKEY, or vice versa, or if one response requests DS removal while another indicates NODATA or a DS update, the state MUST be considered inconsistent.

CDS records MUST be considered for consistency only when their digest type is designated "MUST" in the "Implement for DNSSEC Delegation" column of the "Digest Algorithms" registry [DS-IANA]. Other digest types can be ignored. During initial DS provisioning, conventional DNSSEC validation is not yet available; authenticated bootstrapping [RFC9615] should be used.

The parent can choose, as local policy, which hash digest types to use when publishing a DS RRset. The set of keys referenced by the DS RRset is not local policy: only if all keys from the CDNSKEY RRset and eligible CDS records are included is the DS RRset considered consistent.

3.2. CSYNC

For CSYNC, the Parental Agent MUST query all nameservers listed in the Child's delegation from the Parent and ensure that the CSYNC immediate flag and type bitmap are equal across received responses. The SOA serial field and soaminimum flag can legitimately differ, so each response is assessed with the SOA record from the same nameserver. If the per-nameserver assessments of whether the update is permissible do not all agree, the CSYNC state MUST be considered inconsistent.

When retrieving data RRsets indicated by CSYNC, such as NS or A/AAAA, the Parental Agent MUST query all nameservers from which a CSYNC record was received and ensure that all return equal rdata sets, including the case where all are empty. Existing CSYNC processing rules from [RFC7477] remain in place: when the NS type flag is present, NS processing occurs before possible glue updates so that glue addresses match the correct nameserver set; when the type bitmap contains A/AAAA flags, address queries are sent only for NS hostnames that are in bailiwick, while out-of-bailiwick NS records are ignored. Automated delegation updates MUST NOT break the current delegation, as required by [RFC7344], and Parental Agents SHOULD check that CSYNC-based updates, if applied, do not break the delegation.