# Choose raw OpenZFS sends deliberately for encrypted replication chains

> Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.

- Canonical URL: https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:32:49+00:00
- Modified: 2026-10-15T13:36:15+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.

## Potentially affected

This applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.

## DSE recommendation

DSE recommends deciding whether the receiver should possess decryption authority before the first transfer.

## Article

Set stream encryption and key-custody expectations before establishing an OpenZFS replication chain.

## Source facts

For encrypted datasets, OpenZFS 2.3 raw send transfers data in its on-disk encrypted form and can operate without loaded encryption keys. A received raw dataset retains the sending dataset’s encryption keys, although its key-location setting may differ. Sending that encrypted dataset without raw mode instead sends unencrypted data, potentially re-encrypted by the receiver with a different key. That change prevents later raw incremental sends to that receiving dataset. Raw and decrypted replication choices therefore affect chain continuity.

Source: [OpenZFS 2.3 — zfs send](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html).

## Applicability

This applies to OpenZFS 2.3 native-encrypted dataset sends. It addresses stream encryption and incremental compatibility, not every aspect of transport security or destination account authorization.

## DSE recommendation

DSE recommends deciding whether the receiver should possess decryption authority before the first transfer. Record raw-mode choice, key custody, key-location expectations, and the intended incremental chain in the replication build sheet. Keep an independent, controlled method of recovering required keys. Avoid changing stream mode as an ad hoc troubleshooting step without understanding its effect on subsequent incrementals. Include destination access and transport protections in the separate replication security review, rather than treating raw mode as the whole design.

## Verification

With disposable encrypted datasets, test a full raw transfer followed by an incremental transfer using the intended key state. Verify how the recovered dataset is unlocked by an authorized operator. Retain stream options and key-handling observations without recording private key material in the test evidence.

## Official reference

[OpenZFS 2.3 — zfs send](https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html). Reviewed October 15, 2026.

## Primary reference

- Name: OpenZFS 2.3 — zfs send
- Authority: openzfs.github.io
- URL: https://openzfs.github.io/openzfs-docs/man/v2.3/8/zfs-send.8.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose raw OpenZFS sends deliberately for encrypted replication chains,” DSE Security, https://update.dsesecurity.com/updates/choose-raw-openzfs-sends-deliberately-for-encrypted-replication-chains/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.