NLnet Labs launches Cascade beta 1 hidden DNSSEC signer for public testing

NLnet Labs has made the first beta release of Cascade, its new purpose built hidden DNSSEC signer, available for public testing. The release, codenamed "Slàinte mhath", was announced on 5 June 2026 after a sneak preview at the DNS OARC 46 meeting in Edinburgh in May. Cascade is designed to add DNSSEC signatures to DNS zone data automatically, without operators having to manage the signing process manually. The project team describes this beta as the first in a series of releases that will add the remaining features needed for production use, and they are actively seeking feedback from the community through their forum and GitHub, with Codeberg to follow later this year after migration.

Cascade is being developed because the existing open source signer OpenDNSSEC will reach end-of-life in October 2027. Until that date, OpenDNSSEC will receive only critical bug fixes and security updates, with no new features. Cascade shares the same general approach as OpenDNSSEC: it is a hidden bump-in-the-wire signer, meaning it sits between the authoritative DNS data source and the public DNS, transparently adding DNSSEC signatures. However, Cascade is written in Rust, a memory safe programming language, and has been built with modern operational needs in mind, including fine grained observability. The developers have applied lessons learned from OpenDNSSEC, used sensible defaults based on current best practices, and provided a fresh command line interface that aims to be clear, transparent and simple. Cascade also offers built-in pre-signing and pre-publication review hook functionality. Development over the past year was supported by grants from the Sovereign Tech Agency and the Nominet DNS Fund, and the project is expected to become self-sustaining through support agreements with organisations that run Cascade in critical infrastructure.

The beta release is not backward compatible with the earlier alpha versions, so existing testers must back up their current installation and start fresh. Compared to the last alpha (alpha 5), the beta contains roughly 1.5 times as many lines of Rust code, 1.75 times as much end user documentation, 2,000 new lines of integration test code, 221 merged pull requests, and 114 closed issues. Seven contributors touched 251 files over 363 commits. In total, 125 files were changed, with 7,302 lines added and 5,882 lines deleted, and 47 files removed. The most significant internal change is a complete rewrite of Cascade's core. The earlier event producer consumer architecture has been replaced by a state machine based architecture, which keeps each zone pipeline in a single consistent state at all times. This fixes the inconsistent state issues that were observed in the alpha releases.

The new functionality in beta 1 covers several important operational areas. Incremental signing now works out of the box, meaning that when a zone changes, Cascade only regenerates the DNSSEC signatures that actually need to change, instead of re-signing the entire zone every time. This reduces the load on a hardware security module (HSM) and produces much smaller update messages for downstream nameservers. In one timing example, fully signing a zone with 21,587,503 records took just under a minute, while a subsequent incremental re-sign took only 39 seconds. Unless an operator chooses the "keep" serial policy, Cascade automatically re-signs parts of a zone in stages at regular intervals to keep signatures fresh, spreading the workload deterministically rather than adding random jitter. Cascade beta also persists generated IXFR diffs and the entire signed zone to disk, so a restart does not force downstream nameservers to fetch the whole zone again via AXFR. Support for TSIG message authentication has been added for both incoming and outgoing zone transfers, allowing operators to restrict access to known parties. Cascade can now serve downstream IXFR, not just receive upstream IXFR, and it has better compatibility with BIND nameservers, fixing DNS NOTIFY issues. The beta also adds support for parsing zone files containing record types like IPSECKEY, RP, OPENPGPKEY, SSHFP and TLSA. The review functionality has been extended: the policy settings have been replaced with a clearer review.mode option (off, manual or script), a new review.on-reject setting allows an operator to halt and manually inspect a zone that a script rejects, and a new cascade zone maintenance enable command blocks new operations while allowing in progress work to finish. Finally, the beta exposes a basic set of Prometheus metrics, including gauges for the number of zones configured, loaded and active.

For smaller, rarely changing zones such as cascade.nlnetlabs.nl, the beta is already superior to the alpha series and is good enough for a test environment. The NLnet Labs team runs it in production themselves but does not yet advise others to do so. For larger or rapidly changing zones, more work remains. Known gaps include high memory usage during incremental signing, slower initial full zone signing and HSM signing than the alpha (parallelized signing has not yet been restored), and the accumulation of downstream IXFR diffs without any purge mechanism, which will grow disk and memory usage until a later beta release adds purging. The developers stress that production readiness is coming: the core architecture is now solid, and the dedicated team can focus on closing the remaining gaps. The roadmap includes more testing, documentation improvements, purging old IXFR diffs, adding missing CLI commands such as cascade hsm remove, reducing memory usage, extending Prometheus metrics, re-parallelizing full zone signing, improving migration from existing signing setups, and providing more insight into Cascade's current and future actions. For website owners and IT teams following this development, using a privacy first encrypted DNS resolver like AEU DNS can help ensure that DNSSEC signed zones are validated correctly on your network, adding an extra layer of protection against DNS spoofing.