diff --git a/java/google/registry/model/domain/DomainBase.java b/java/google/registry/model/domain/DomainBase.java
index 00921d29d..6f5087564 100644
--- a/java/google/registry/model/domain/DomainBase.java
+++ b/java/google/registry/model/domain/DomainBase.java
@@ -27,7 +27,6 @@ import static google.registry.model.ofy.ObjectifyService.ofy;
 import static google.registry.util.CollectionUtils.forceEmptyToNull;
 import static google.registry.util.CollectionUtils.nullToEmpty;
 import static google.registry.util.CollectionUtils.nullToEmptyImmutableCopy;
-import static google.registry.util.CollectionUtils.nullToEmptyImmutableSortedCopy;
 import static google.registry.util.CollectionUtils.union;
 import static google.registry.util.DateTimeUtils.earliestOf;
 import static google.registry.util.DateTimeUtils.isBeforeOrAt;
@@ -254,8 +253,8 @@ public class DomainBase extends EppResource
     return fullyQualifiedDomainName;
   }
 
-  public ImmutableSortedSet<DelegationSignerData> getDsData() {
-    return nullToEmptyImmutableSortedCopy(dsData);
+  public ImmutableSet<DelegationSignerData> getDsData() {
+    return nullToEmptyImmutableCopy(dsData);
   }
 
   public LaunchNotice getLaunchNotice() {
diff --git a/java/google/registry/model/domain/secdns/DelegationSignerData.java b/java/google/registry/model/domain/secdns/DelegationSignerData.java
index 7c0926234..4ae599bdc 100644
--- a/java/google/registry/model/domain/secdns/DelegationSignerData.java
+++ b/java/google/registry/model/domain/secdns/DelegationSignerData.java
@@ -30,8 +30,7 @@ import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
  */
 @Embed
 @XmlType(name = "dsData")
-public class DelegationSignerData
-    extends ImmutableObject implements Comparable<DelegationSignerData> {
+public class DelegationSignerData extends ImmutableObject {
 
   /** The identifier for this particular key in the domain. */
   int keyTag;
@@ -85,11 +84,6 @@ public class DelegationSignerData
     return instance;
   }
 
-  @Override
-  public int compareTo(DelegationSignerData other) {
-    return Integer.compare(getKeyTag(), other.getKeyTag());
-  }
-
   /**
    * Returns the presentation format of this DS record.
    *
diff --git a/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java b/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
index 7b1a8b382..ee0412f2b 100644
--- a/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
+++ b/javatests/google/registry/flows/domain/DomainUpdateFlowTest.java
@@ -97,7 +97,13 @@ import org.junit.Test;
 public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow, DomainBase> {
 
   private static final DelegationSignerData SOME_DSDATA =
-      DelegationSignerData.create(1, 2, 3, new byte[] {0, 1, 2});
+      DelegationSignerData.create(1, 2, 3, base16().decode("0123"));
+  private static final ImmutableMap<String, String> OTHER_DSDATA_TEMPLATE_MAP =
+      ImmutableMap.of(
+          "KEY_TAG", "12346",
+          "ALG", "3",
+          "DIGEST_TYPE", "1",
+          "DIGEST", "38EC35D5B3A34B44C39B");
 
   ContactResource sh8013Contact;
   ContactResource mak21Contact;
@@ -432,7 +438,16 @@ public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow,
       ImmutableSet<DelegationSignerData> originalDsData,
       ImmutableSet<DelegationSignerData> expectedDsData)
       throws Exception {
-    setEppInput(xmlFilename);
+    doSecDnsSuccessfulTest(xmlFilename, originalDsData, expectedDsData, OTHER_DSDATA_TEMPLATE_MAP);
+  }
+
+  private void doSecDnsSuccessfulTest(
+      String xmlFilename,
+      ImmutableSet<DelegationSignerData> originalDsData,
+      ImmutableSet<DelegationSignerData> expectedDsData,
+      ImmutableMap<String, String> substitutions)
+      throws Exception {
+    setEppInput(xmlFilename, substitutions);
     persistResource(
         newDomainBase(getUniqueIdFromCommand()).asBuilder().setDsData(originalDsData).build());
     assertTransactionalFlow(true);
@@ -453,7 +468,9 @@ public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow,
         "domain_update_dsdata_add.xml",
         null,
         ImmutableSet.of(
-            DelegationSignerData.create(12346, 3, 1, base16().decode("38EC35D5B3A34B44C39B"))));
+            DelegationSignerData.create(12346, 3, 1, base16().decode("38EC35D5B3A34B44C39B"))),
+        ImmutableMap.of(
+            "KEY_TAG", "12346", "ALG", "3", "DIGEST_TYPE", "1", "DIGEST", "38EC35D5B3A34B44C39B"));
   }
 
   @Test
@@ -463,7 +480,66 @@ public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow,
         ImmutableSet.of(SOME_DSDATA),
         ImmutableSet.of(
             SOME_DSDATA,
-            DelegationSignerData.create(12346, 3, 1, base16().decode("38EC35D5B3A34B44C39B"))));
+            DelegationSignerData.create(12346, 3, 1, base16().decode("38EC35D5B3A34B44C39B"))),
+        ImmutableMap.of(
+            "KEY_TAG", "12346", "ALG", "3", "DIGEST_TYPE", "1", "DIGEST", "38EC35D5B3A34B44C39B"));
+  }
+
+  @Test
+  public void testSuccess_secDnsAddSameDoesNothing() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableMap.of("KEY_TAG", "1", "ALG", "2", "DIGEST_TYPE", "3", "DIGEST", "0123"));
+  }
+
+  @Test
+  public void testSuccess_secDnsAddOnlyKeyTagRemainsSame() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(
+            SOME_DSDATA, DelegationSignerData.create(1, 8, 4, base16().decode("4567"))),
+        ImmutableMap.of("KEY_TAG", "1", "ALG", "8", "DIGEST_TYPE", "4", "DIGEST", "4567"));
+  }
+
+  // Changing any of the four fields in DelegationSignerData should result in a new object
+  @Test
+  public void testSuccess_secDnsAddOnlyChangeKeyTag() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(
+            SOME_DSDATA, DelegationSignerData.create(12346, 2, 3, base16().decode("0123"))),
+        ImmutableMap.of("KEY_TAG", "12346", "ALG", "2", "DIGEST_TYPE", "3", "DIGEST", "0123"));
+  }
+
+  @Test
+  public void testSuccess_secDnsAddOnlyChangeAlgorithm() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(SOME_DSDATA, DelegationSignerData.create(1, 8, 3, base16().decode("0123"))),
+        ImmutableMap.of("KEY_TAG", "1", "ALG", "8", "DIGEST_TYPE", "3", "DIGEST", "0123"));
+  }
+
+  @Test
+  public void testSuccess_secDnsAddOnlyChangeDigestType() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(SOME_DSDATA, DelegationSignerData.create(1, 2, 4, base16().decode("0123"))),
+        ImmutableMap.of("KEY_TAG", "1", "ALG", "2", "DIGEST_TYPE", "4", "DIGEST", "0123"));
+  }
+
+  @Test
+  public void testSuccess_secDnsAddOnlyChangeDigest() throws Exception {
+    doSecDnsSuccessfulTest(
+        "domain_update_dsdata_add.xml",
+        ImmutableSet.of(SOME_DSDATA),
+        ImmutableSet.of(SOME_DSDATA, DelegationSignerData.create(1, 2, 3, base16().decode("4567"))),
+        ImmutableMap.of("KEY_TAG", "1", "ALG", "2", "DIGEST_TYPE", "3", "DIGEST", "4567"));
   }
 
   @Test
@@ -699,7 +775,7 @@ public class DomainUpdateFlowTest extends ResourceFlowTestCase<DomainUpdateFlow,
       builder.add(DelegationSignerData.create(i, 2, 3, new byte[] {0, 1, 2}));
     }
 
-    setEppInput("domain_update_dsdata_add.xml");
+    setEppInput("domain_update_dsdata_add.xml", OTHER_DSDATA_TEMPLATE_MAP);
     persistResource(
         newDomainBase(getUniqueIdFromCommand()).asBuilder().setDsData(builder.build()).build());
     EppException thrown = assertThrows(TooManyDsRecordsException.class, this::runFlow);
diff --git a/javatests/google/registry/flows/domain/testdata/domain_update_dsdata_add.xml b/javatests/google/registry/flows/domain/testdata/domain_update_dsdata_add.xml
index 820b19c2a..f06b806e0 100644
--- a/javatests/google/registry/flows/domain/testdata/domain_update_dsdata_add.xml
+++ b/javatests/google/registry/flows/domain/testdata/domain_update_dsdata_add.xml
@@ -13,10 +13,10 @@
        xmlns:secDNS="urn:ietf:params:xml:ns:secDNS-1.1">
         <secDNS:add>
           <secDNS:dsData>
-            <secDNS:keyTag>12346</secDNS:keyTag>
-            <secDNS:alg>3</secDNS:alg>
-            <secDNS:digestType>1</secDNS:digestType>
-            <secDNS:digest>38EC35D5B3A34B44C39B</secDNS:digest>
+            <secDNS:keyTag>%KEY_TAG%</secDNS:keyTag>
+            <secDNS:alg>%ALG%</secDNS:alg>
+            <secDNS:digestType>%DIGEST_TYPE%</secDNS:digestType>
+            <secDNS:digest>%DIGEST%</secDNS:digest>
           </secDNS:dsData>
         </secDNS:add>
       </secDNS:update>
diff --git a/javatests/google/registry/tools/GenerateDnsReportCommandTest.java b/javatests/google/registry/tools/GenerateDnsReportCommandTest.java
index e042d87dc..367c075b5 100644
--- a/javatests/google/registry/tools/GenerateDnsReportCommandTest.java
+++ b/javatests/google/registry/tools/GenerateDnsReportCommandTest.java
@@ -30,6 +30,7 @@ import com.beust.jcommander.ParameterException;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
+import com.google.common.collect.Lists;
 import com.google.common.net.InetAddresses;
 import com.googlecode.objectify.Key;
 import google.registry.model.domain.DomainBase;
@@ -42,6 +43,7 @@ import java.io.Reader;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.List;
 import org.joda.time.DateTime;
 import org.json.simple.JSONValue;
 import org.json.simple.parser.ParseException;
@@ -72,22 +74,34 @@ public class GenerateDnsReportCommandTest extends CommandTestCase<GenerateDnsRep
   private HostResource nameserver4;
   private DomainBase domain1;
 
+  private static final ImmutableList<?> DS_DATA_OUTPUT = ImmutableList.of(
+      ImmutableMap.of(
+          "keyTag", 12345L,
+          "algorithm", 3L,
+          "digestType", 1L,
+          "digest", "49FD46E6C4B45C55D4AC"),
+      ImmutableMap.of(
+          "keyTag", 56789L,
+          "algorithm", 2L,
+          "digestType", 4L,
+          "digest", "69FD46E6C4A45C55D4AC"));
+
+  private static final List<?> DS_DATA_OUTPUT_REVERSED = Lists.reverse(DS_DATA_OUTPUT);
+
   private static final ImmutableMap<String, ?> DOMAIN1_OUTPUT = ImmutableMap.of(
       "domain", "example.xn--q9jyb4c",
       "nameservers", ImmutableList.of(
           "ns1.example.xn--q9jyb4c",
           "ns2.example.xn--q9jyb4c"),
-      "dsData", ImmutableList.of(
-          ImmutableMap.of(
-              "keyTag", 12345L,
-              "algorithm", 3L,
-              "digestType", 1L,
-              "digest", "49FD46E6C4B45C55D4AC"),
-          ImmutableMap.of(
-              "keyTag", 56789L,
-              "algorithm", 2L,
-              "digestType", 4L,
-              "digest", "69FD46E6C4A45C55D4AC")));
+      "dsData", DS_DATA_OUTPUT);
+
+  // We can't guarantee inner ordering
+  private static final ImmutableMap<String, ?> DOMAIN1_OUTPUT_ALT = ImmutableMap.of(
+      "domain", "example.xn--q9jyb4c",
+      "nameservers", ImmutableList.of(
+          "ns1.example.xn--q9jyb4c",
+          "ns2.example.xn--q9jyb4c"),
+      "dsData", DS_DATA_OUTPUT_REVERSED);
 
   private static final ImmutableMap<String, ?> DOMAIN2_OUTPUT = ImmutableMap.of(
       "domain", "foobar.xn--q9jyb4c",
@@ -146,60 +160,63 @@ public class GenerateDnsReportCommandTest extends CommandTestCase<GenerateDnsRep
   @Test
   public void testSuccess() throws Exception {
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson()).isEqualTo(
-        ImmutableList.of(DOMAIN1_OUTPUT, DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    Iterable<?> output = (Iterable<?>) getOutputAsJson();
+    assertThat(output).containsAnyOf(DOMAIN1_OUTPUT, DOMAIN1_OUTPUT_ALT);
+    assertThat(output).containsAllOf(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipDeletedDomain() throws Exception {
     persistResource(domain1.asBuilder().setDeletionTime(now).build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    assertThat((Iterable<?>) getOutputAsJson())
+        .containsExactly(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipDeletedNameserver() throws Exception {
-    persistResource(
-        nameserver1.asBuilder().setDeletionTime(now).build());
+    persistResource(nameserver1.asBuilder().setDeletionTime(now).build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN1_OUTPUT, DOMAIN2_OUTPUT, NAMESERVER2_OUTPUT));
+    Iterable<?> output = (Iterable<?>) getOutputAsJson();
+    assertThat(output).containsAnyOf(DOMAIN1_OUTPUT, DOMAIN1_OUTPUT_ALT);
+    assertThat(output).containsAllOf(DOMAIN2_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipClientHoldDomain() throws Exception {
     persistResource(domain1.asBuilder().addStatusValue(StatusValue.CLIENT_HOLD).build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    assertThat((Iterable<?>) getOutputAsJson())
+        .containsExactly(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipServerHoldDomain() throws Exception {
     persistResource(domain1.asBuilder().addStatusValue(StatusValue.SERVER_HOLD).build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    assertThat((Iterable<?>) getOutputAsJson())
+        .containsExactly(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipPendingDeleteDomain() throws Exception {
-    persistResource(domain1.asBuilder()
-        .addStatusValue(StatusValue.PENDING_DELETE)
-        .setDeletionTime(now.plusDays(30))
-        .build());
+    persistResource(
+        domain1
+            .asBuilder()
+            .addStatusValue(StatusValue.PENDING_DELETE)
+            .setDeletionTime(now.plusDays(30))
+            .build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    assertThat((Iterable<?>) getOutputAsJson())
+        .containsExactly(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test
   public void testSuccess_skipDomainsWithoutNameservers() throws Exception {
     persistResource(domain1.asBuilder().setNameservers(ImmutableSet.of()).build());
     runCommand("--output=" + output, "--tld=xn--q9jyb4c");
-    assertThat(getOutputAsJson())
-        .isEqualTo(ImmutableList.of(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT));
+    assertThat((Iterable<?>) getOutputAsJson())
+        .containsExactly(DOMAIN2_OUTPUT, NAMESERVER1_OUTPUT, NAMESERVER2_OUTPUT);
   }
 
   @Test