tptacek - I was waiting for your reply... almost thought about setting a timer! Glad to see you didn't disappoint. Toward the end of the article you'll note I

tptacek - I was waiting for your reply... almost thought about setting a timer! Glad to see you didn't disappoint. Toward the end of the article you'll note I point out that this is a great example of a hole in the operational process that has been identified as more and more people have deployed DNSSEC: http://www.internetsociety.org/deploy360/blog/2015/02/cloudflare-wants-to-update-dns-registration-model-to-automate-dnssec/ http://www.internetsociety.org/deploy360/blog/2015/02/cloudf... The process of updating (or removing) the DS record NEEDS to be automated. There is a group within the industry working on ideas around this now and I think we'll see that work happen inside the DNSOP Working Group within the IETF. There is a public mailing list open to anyone interested to join.