{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "item": { "id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "slug": "choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains", "url": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains.md", "json": "https://update.dsesecurity.com/api/v1/posts/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/" }, "title": "Choose raw OpenZFS sends deliberately for encrypted replication chains", "summary": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:32:49+00:00", "modified_at": "2026-10-15T13:36:15+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 252, "potentially_affected": "This applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.", "dse_recommendation": "DSE recommends deciding whether the receiver should possess decryption authority before the first transfer.", "primary_source": { "name": "OpenZFS 2.3 — zfs send", "url": "https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html", "published_on": null, "authority": "openzfs.github.io" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.

\n

Source facts

\n

For encrypted datasets, OpenZFS 2.3 raw send transfers data in its on-disk encrypted form and can operate without loaded encryption keys. A received raw dataset retains the sending dataset’s encryption keys, although its key-location setting may differ. Sending that encrypted dataset without raw mode instead sends unencrypted data, potentially re-encrypted by the receiver with a different key. That change prevents later raw incremental sends to that receiving dataset. Raw and decrypted replication choices therefore affect chain continuity.

\n

Source: OpenZFS 2.3 — zfs send.

\n

Applicability

\n

This applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.

\n

DSE recommendation

\n

DSE recommends deciding whether the receiver should possess decryption authority before the first transfer. Record raw-mode choice, key custody, key-location expectations, and the intended incremental chain in the replication build sheet. Keep an independent, controlled method of recovering required keys. Avoid changing stream mode as an ad hoc troubleshooting step without understanding its effect on subsequent incrementals. Include destination access and transport protections in the separate replication security review, rather than treating raw mode as the whole design.

\n

Verification

\n

With disposable encrypted datasets, test a full raw transfer followed by an incremental transfer using the intended key state. Verify how the recovered dataset is unlocked by an authorized operator. Retain stream options and key-handling observations without recording private key material in the test evidence.

\n

Official reference

\n

OpenZFS 2.3 — zfs send. Reviewed October 15, 2026.

", "content_text": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.\nSource facts\nFor encrypted datasets, OpenZFS 2.3 raw send transfers data in its on-disk encrypted form and can operate without loaded encryption keys. A received raw dataset retains the sending dataset’s encryption keys, although its key-location setting may differ. Sending that encrypted dataset without raw mode instead sends unencrypted data, potentially re-encrypted by the receiver with a different key. That change prevents later raw incremental sends to that receiving dataset. Raw and decrypted replication choices therefore affect chain continuity.\nSource: OpenZFS 2.3 — zfs send.\nApplicability\nThis applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.\nDSE recommendation\nDSE recommends deciding whether the receiver should possess decryption authority before the first transfer. Record raw-mode choice, key custody, key-location expectations, and the intended incremental chain in the replication build sheet. Keep an independent, controlled method of recovering required keys. Avoid changing stream mode as an ad hoc troubleshooting step without understanding its effect on subsequent incrementals. Include destination access and transport protections in the separate replication security review, rather than treating raw mode as the whole design.\nVerification\nWith disposable encrypted datasets, test a full raw transfer followed by an incremental transfer using the intended key state. Verify how the recovered dataset is unlocked by an authorized operator. Retain stream options and key-handling observations without recording private key material in the test evidence.\nOfficial reference\nOpenZFS 2.3 — zfs send. Reviewed October 15, 2026.", "content_markdown": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.\n\n## Source facts\n\nFor encrypted datasets, OpenZFS 2.3 raw send transfers data in its on-disk encrypted form and can operate without loaded encryption keys. A received raw dataset retains the sending dataset’s encryption keys, although its key-location setting may differ. Sending that encrypted dataset without raw mode instead sends unencrypted data, potentially re-encrypted by the receiver with a different key. That change prevents later raw incremental sends to that receiving dataset. Raw and decrypted replication choices therefore affect chain continuity.\n\nSource: [OpenZFS 2.3 — zfs send](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html).\n\n## Applicability\n\nThis applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.\n\n## DSE recommendation\n\nDSE recommends deciding whether the receiver should possess decryption authority before the first transfer. Record raw-mode choice, key custody, key-location expectations, and the intended incremental chain in the replication build sheet. Keep an independent, controlled method of recovering required keys. Avoid changing stream mode as an ad hoc troubleshooting step without understanding its effect on subsequent incrementals. Include destination access and transport protections in the separate replication security review, rather than treating raw mode as the whole design.\n\n## Verification\n\nWith disposable encrypted datasets, test a full raw transfer followed by an incremental transfer using the intended key state. Verify how the recovered dataset is unlocked by an authorized operator. Retain stream options and key-handling observations without recording private key material in the test evidence.\n\n## Official reference\n\n[OpenZFS 2.3 — zfs send](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "url": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose raw OpenZFS sends deliberately for encrypted replication chains", "item": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/#article", "identifier": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "url": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/", "headline": "Choose raw OpenZFS sends deliberately for encrypted replication chains", "description": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.", "abstract": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.", "articleBody": "Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.\nSource facts\nFor encrypted datasets, OpenZFS 2.3 raw send transfers data in its on-disk encrypted form and can operate without loaded encryption keys. A received raw dataset retains the sending dataset’s encryption keys, although its key-location setting may differ. Sending that encrypted dataset without raw mode instead sends unencrypted data, potentially re-encrypted by the receiver with a different key. That change prevents later raw incremental sends to that receiving dataset. Raw and decrypted replication choices therefore affect chain continuity.\nSource: OpenZFS 2.3 — zfs send.\nApplicability\nThis applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.\nDSE recommendation\nDSE recommends deciding whether the receiver should possess decryption authority before the first transfer. Record raw-mode choice, key custody, key-location expectations, and the intended incremental chain in the replication build sheet. Keep an independent, controlled method of recovering required keys. Avoid changing stream mode as an ad hoc troubleshooting step without understanding its effect on subsequent incrementals. Include destination access and transport protections in the separate replication security review, rather than treating raw mode as the whole design.\nVerification\nWith disposable encrypted datasets, test a full raw transfer followed by an incremental transfer using the intended key state. Verify how the recovered dataset is unlocked by an authorized operator. Retain stream options and key-handling observations without recording private key material in the test evidence.\nOfficial reference\nOpenZFS 2.3 — zfs send. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:32:49+00:00", "dateModified": "2026-10-15T13:36:15+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose raw OpenZFS sends deliberately for encrypted replication chains" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 252, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "OpenZFS 2.3 — zfs send", "url": "https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html" } } ] } }