While testing DNSSEC setup with the tools - pass all good green on Verisignlabs but there is warning from dnsviz:
mydomain .com/CDS: The contents of the DS RRset are inconsistent with those of the CDS RRset. See RFC 7344, Sec. 3, RFC 7344, Sec. 5.
Why is that, and will it cause any trouble?
I can’t figure out what this warning implies.
Maybe because algorithm is different (13 vs 8) between zones?
DNSViz is a bit too critical here I think.
DS and CDS RRsets derive from the KSK/CSK DNSKEY records. Depending on the registry for your parent domain one or more of those offered by deSEC may be used. But not necessarily all of them. I think the current DNSSEC specification mandates a DS record using certain hash algorithm. So there ought to be an overlap between the records offered by deSEC and those actually used.
The CDS records are meant for mechanisms that automate setting the DS records in the parent domain. So they have no direct function within the domain. Sadly not many registrars/registries implement these mechanisms yet. See Support for CDS/CDNSKEY/CSYNC updates.
TLDR: Don’t worry about it.
fiwswe
It’s probably this. Technically the parent zone is supposed to publish a DS RRset that is identical to the CDS RRset published by the child zone. As per the RFC, a difference between the two indicates that the child wants the parent to update the DS RRset. In practice the child merely offers CDS records and there is no harm if the parent chooses a subset. Desec offers an additional algorithm that the parent zone doesn’t support and thus the parent zone only uses the record with the information for the algorithm that it does support. You get a warning because DNSViz wants to alert you to an impending change (that isn’t actually coming though). It is not an error.