CSYNC Record DNSSEC

The CSYNC record (Child-to-Parent Synchronization) enables automated synchronization of DNS records from child zones to parent zones. Defined in RFC 7477, it allows child zones to signal desired changes to NS records and glue (A/AAAA records).

What Is a CSYNC Record?

CSYNC records allow child zone administrators to update delegation information in the parent zone without manual intervention:

• NS synchronization — Update nameserver delegation records
• Glue record sync — Update A/AAAA records for in-zone nameservers
• Automated updates — Parent processes changes automatically
• Reduced errors — Eliminates manual coordination

CSYNC Record Format

example.com.    3600    IN    CSYNC    2024040100 3 A AAAA NS

CSYNC Record Fields

CSYNC Flags

Flags can be combined: 3 = immediate + soaminimum (most common).

Supported Record Types

CSYNC can request synchronization of:

• NS — Nameserver records (delegation)
• A — IPv4 glue records
• AAAA — IPv6 glue records

How CSYNC Works

1. Child zone publishes CSYNC record with desired changes
2. CSYNC specifies which record types to synchronize
3. Parent zone operator polls child zones for CSYNC
4. Parent validates CSYNC is properly signed (DNSSEC)
5. Parent updates delegation NS and glue records
6. Child can update/remove CSYNC after sync completes

CSYNC Examples

Synchronize All (NS + Glue)

example.com.    CSYNC    2024040100 3 A AAAA NS

NS Records Only

example.com.    CSYNC    2024040100 3 NS

Update Glue Only

example.com.    CSYNC    2024040100 3 A AAAA

CSYNC vs CDS/CDNSKEY

When to Use CSYNC

• Changing nameservers — Update NS records in parent automatically
• Adding/removing NS — Modify nameserver set
• Updating glue IPs — Change IP addresses of in-zone nameservers
• Automated operations — Reduce manual registry interactions

CSYNC Best Practices

• Use DNSSEC — CSYNC must be signed for parent to trust it.
• Use flag 3 — Combine immediate + soaminimum for safety.
• Match SOA serial — CSYNC serial should match current SOA.
• Test before deploying — Verify CSYNC triggers expected changes.
• Remove after sync — Clean up CSYNC once delegation is updated.

Registry Support

CSYNC support varies by TLD and registry. Check with your registrar/registry for CSYNC processing support.

Troubleshooting CSYNC

Common issues and solutions:

• Parent not processing — Verify registry supports CSYNC.
• DNSSEC validation fails — Ensure zone is properly signed.
• Serial mismatch — CSYNC serial must match or precede SOA serial.
• Invalid type bitmap — Only A, AAAA, NS are valid.
• Processing delay — Parents may poll infrequently.

Related Record Types

• NS Record — Nameserver delegation
• CDS Record — Child DS signaling
• CDNSKEY Record — Child DNSKEY signaling
• SOA Record — Zone authority and serial