DNSSEC secures the DNS with a chain of signatures from the root down to a domain's own zone. The link between a parent and a child zone is a DS record, and whoever operates the parent side, a registry or registrar, can replace it. Usually that's a routine key rollover, but there's currently no way to tell that from something else: the DNS doesn't keep a history of its own trust chain.
The web PKI had the same structural problem and fixed it in 2013 with Certificate Transparency: every certificate a CA issues is logged publicly, so misissuance gets caught instead of just forbidden. DNSSEC never got an equivalent. That's part of why a family of IETF standards that would anchor real identity in DNS — DANE for mail, SMIMEA for personal S/MIME certificates, DANCE for client auth — has stayed mostly unused: nobody can tell whether the layer underneath has been tampered with.
ds-watch watches that layer directly. It runs a daily batch pipeline in Python: download the zone file from ICANN's CZDS, once per zone per 24h, exactly as the terms of use require. Stream-parse the DS, DNSKEY and RRSIG records out of a multi-gigabyte file without holding it all in memory. Diff against yesterday's snapshot per delegation, and publish every difference — added, changed, removed — to an append-only log. Every event carries the registry's own signature over the record, so it's a verifiable statement rather than an operator's claim. A sanity gate catches the most common real failure mode, a truncated download that would otherwise look like a mass wave of removals, and quarantines it instead of publishing garbage.
It currently covers .org, .info and .dev, a bit over a million signed delegations combined, and has run as a small production service (Contabo VPS, systemd timer, Caddy, hardened, key-only SSH access) since early July
- The near-term roadmap: a self-service watchlist for domain owners,
churn statistics once there's enough history to say something about normal versus anomalous key changes, and a problem-statement Internet-Draft for dnsop once there's enough operational history to write one.