DNS Root Key Rollover Scheduled for October 11, 2026

The DNS root is scheduled to change its key-signing key (KSK) on October 11, 2026, marking only the second such rollover in history. This key anchors the DNSSEC chain of trust, allowing resolvers to authenticate DNS answers via cryptographic signatures. If a validating resolver does not trust the new key before the switch, healthy websites may become unreachable for its users.

Key Details and Timeline

The new key, KSK-2024 (key tag 38696), will replace KSK-2017 (key tag 20326) as the signer of the root’s DNSKEY set. KSK-2024 has been published in the root’s DNSKEY set since January 11, 2025, allowing resolvers with automatic trust-anchor updates to discover and accept it ahead of the deadline. Both keys use the same RSA/SHA-256 algorithm, so the rollover exercises the distribution process without changing cryptographic methods.

Checking Resolver Readiness

Most website operators do not need to take action, but those running DNSSEC-validating resolvers must ensure they trust KSK-2024. Cloudflare’s 1.1.1.1 and Gateway DNS already trust the new key. Users can verify their resolver’s status using the RFC 8509 trust anchor sentinel protocol via Cloudflare’s readiness test at dnstest.dev/ksk-2024. The test queries special domains (is-ta-38696 and not-ta-38696) to determine if the resolver accepts the new key.

Future Implications

This rollover serves as a practice run for future changes, including a proposed move to ECDSA P-256 and eventual adoption of post-quantum cryptography like ML-DSA-44. ICANN plans to revoke KSK-2017 in 2027. The exercise highlights the importance of robust trust-anchor management, as failures in this process can cause widespread DNS outages even when the underlying cryptography is sound.