DNS root KSK rollover set for October 11, 2026; resolvers urged to verify trust anchors

On October 11, 2026, KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326) as the DNS root's key-signing key; validating resolvers that do not already trust the new key risk failing DNSSEC checks for names under every TLD.

The DNS root zone is scheduled to roll its key-signing key on October 11, 2026, only the second such rollover ever. KSK-2024 (key tag 38696) will replace KSK-2017 (key tag 20326) as the signer of the root DNSKEY set. Validating resolvers that do not trust the new key — for example, where RFC 5011 automated trust anchor updates are disabled — can fail DNSSEC validation, making names under every top-level domain unreachable. KSK-2024 has been published since January 11, 2025, and Cloudflare added it to its 1.1.1.1 resolver and Gateway DNS trust anchors in July 2024. Both Cloudflare (2026-10-06) and Akamai (2026-10-08) have published readiness guidance for DNS operators. Cloudflare highlights RFC 8509 sentinel queries as a way for operators to test resolver readiness and notes that most website operators need no changes.

• Root KSK rollover is scheduled for October 11, 2026, only the second ever
• KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326) as the signer of the root DNSKEY set
• Resolvers lacking the new trust anchor — e.g., where RFC 5011 automated updates are disabled — risk DNSSEC validation failures affecting names under every TLD
• KSK-2024 has been published since January 11, 2025
• Cloudflare 1.1.1.1 and Gateway DNS already trust KSK-2024, having added it in July 2024
• RFC 8509 sentinel queries let operators test resolver readiness
• Akamai has published readiness guidance for DNS operators ahead of the rollover
• Most website operators need no changes, per Cloudflare