It’s probably this. Technically the parent zone is supposed to publish a DS RRset that is identical to the CDS RRset published by the child zone. As per the RFC, a difference between the two indicates that the child wants the parent to update the DS RRset. In practice the child merely offers CDS records and there is no harm if the parent chooses a subset. Desec offers an additional algorithm that the parent zone doesn’t support and thus the parent zone only uses the record with the information for the algorithm that it does support. You get a warning because DNSViz wants to alert you to an impending change (that isn’t actually coming though). It is not an error.
2 Likes