DNS root zone now signed by new key KSK-2024, resolvers must trust it

DNS root zone now signed by new key KSK-2024, resolvers must trust it

11 October 2026: The root of the internet's naming system is now signed with a new key. KSK-2024, key tag 38696, is now signing the root zone, and the key it replaced, KSK-2017, has stopped. A DNSSEC-validating resolver that does not trust the new key can answer SERVFAIL for every name, so websites that are running perfectly will look unreachable to its users.

Not yet independently verified. Not yet independently verified. The revocation date of 11 January 2027 and the removal date of 22 March 2027 for the old key come from a news report citing IANA; we did not find them on the IANA or ICANN pages we read. We will update this when it can be confirmed, and remove this note. We will update this when it can be confirmed, and remove this note.

What changed in the root

IANA's trust anchor page records that KSK-2024 has signed since 2026-10-11, and that KSK-2017, which signed between 2018-10-11 and 2026-10-11, remains a valid trust anchor for now. This is the second root key rollover, after the first in 2018, so for most administrators it is a rare event with no routine to fall back on.

The new key was published in advance. IANA released the new trust anchor in 2024 and, according to iThome's account of the announcement, added KSK-2024 to the root zone in January 2025 so that resolvers had time to learn it. Resolvers that implement the automatic update mechanism in RFC 5011 pick up a new key by watching it in the zone while the current key signs it, and need no manual change.

Who can be hit

ICANN's page for resolver operators carries a reminder dated 11 October. It tells operators of validating resolvers to check that KSK-2024 with key tag 38696 is in their trust anchor configuration, and warns them not to assume automatic updates succeeded. If the key is missing, they should confirm that automatic updates are switched on and follow their resolver vendor's guidance.

That covers anyone running their own validating resolver: an in-house BIND, Unbound or Knot resolver, a network appliance or router that has not been updated for a long time, and machine images built long ago that carry a frozen trust anchor file. Resolvers shipped with current operating system packages normally receive the new key through ordinary updates. IANA says vendors differ in how and when they distribute trust anchor updates, so the date a given product learned the key varies.

How to check your own resolver

The first test is whether the configured trust anchors list key tag 38696. The second is whether lookups of a name you know is DNSSEC-signed still succeed through that resolver. SERVFAIL on many unrelated domains, while the same names resolve through another resolver, points to a stale trust anchor. IANA supplies a standalone tool and an XML file of the trust anchors that validating resolvers can use.

A resolver that has trusted only the old key can recover by adding the new one from IANA's published data, verified as the IANA documentation describes, rather than by switching validation off.

The old key is not gone yet

iThome reports, citing IANA's schedule, that KSK-2017 stays in the root zone until it is revoked on 11 January 2027 and removed on 22 March 2027. IANA's page also lists a third key, tag 46211, as one that will not be used because KSK-2024 supersedes it. The months before the revocation are the time to find resolvers that were missed.

Sources

• ICANN, Root Zone KSK Rollover: Reminder for Resolver Operators, 11 October 2026
• IANA, DNSSEC Trust Anchors and Rollovers (read 2026-10-12), 12 October 2026
• iThome, DNS root zone changes signing key after eight years, 12 October 2026