The Internet's Domain Name System root is scheduled to switch its active key-signing key on October 11, 2026, in only the second root key rollover in DNSSEC history. The change replaces KSK-2017 (key tag 20326) with KSK-2024 (key tag 38696). Validating DNS resolvers that do not trust the replacement key by October 11 will fail cryptographic signature verification, causing healthy websites across affected top-level domains to become unreachable.
Trust Anchors and Automatic Key Discovery
DNSSEC validation depends on a chain of trust that begins at the root zone. Because the root lacks a parent zone to verify its credentials, validating resolvers rely on pre-configured trust anchors. Under RFC 5011, resolvers automatically discover replacement keys when published in the root DNSKEY set. KSK-2024 has been present in the root zone since January 11, 2025. To accept a new key automatically, a resolver must observe and cryptographically verify it continuously for at least 30 days. However, past experience shows software updates or machine migrations can wipe learned key states, leading providers like Cloudflare to bake KSK-2024 directly into software builds alongside KSK-2017 as of July 2024.
Checking Readiness with RFC 8509 Sentinels
To verify whether an upstream resolver trusts the upcoming key, operators can use the root key trust anchor sentinel mechanism defined in RFC 8509. The protocol sends specially formatted domain queries such as is-ta-38696 and not-ta-38696 to test resolver support. A validating resolver that trusts KSK-2024 returns standard DNS address records for the trusted query and deliberately returns a SERVFAIL status for the non-trusted query. Cloudflare has enabled RFC 8509 support in 1.1.1.1 and Gateway DNS to allow administrators and web users to test their connection paths before the switch.
Algorithm Retention and Future Cryptographic Steps
The October 2026 rollover updates the signing key pair while keeping the existing RSA/SHA-256 algorithm unchanged. Following the switch, ICANN plans to revoke KSK-2017, remove it from the root zone, and destroy its private key in 2027. Future initiatives under discussion include migrating the root to smaller ECDSA P-256 signatures and eventually deploying post-quantum trust anchors such as ML-DSA-44. Conducting regular key rollovers ensures operators can reliably update trust anchors before transitioning to next-generation algorithms.
AI-generated editorial illustration; not a documentary photograph.
Source: The keys to the Internet change on October 11. Are you ready?
SIGNAL TITANS
Leave a Reply