Skip to Content

The DNS root changes its signing key on October 11: what resolvers should check

On October 11, 2026 the DNS root replaces the KSK-2017 key with KSK-2024, for only the second time in its history. Anyone running a resolver that validates DNSSEC should confirm it already trusts the new one.
October 6, 2026
Curated Medium

What it says

  • On October 11, 2026, the DNS root changes its key signing key (KSK) for only the second time in its history: KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326) as the signer of the root DNSKEY set.
  • KSK-2024 has been published in the root since January 11, 2025. RFC 5011 requires resolvers to wait at least 30 days before accepting it, so those that update themselves should already have it.
  • Most people who run websites do not need to do anything. Anyone running a resolver that validates DNSSEC should check that it trusts KSK-2024: if it does not, healthy websites may become unreachable.
  • Cloudflare offers a check based on RFC 8509 and says its services (1.1.1.1, Gateway DNS and the DNS of the domains it hosts) already trust the new key.
  • Both keys use RSA/SHA-256. ICANN plans to revoke KSK-2017 in 2027 and has proposed changing the algorithm to ECDSA P-256 in the future.

The Tech Guardian summarizes and comments in its own words on third-party publications. The full information belongs to the original source, which we recommend you read.

Our take

If your company uses the resolvers of its operator or a large public provider, you do not need to do anything. If it runs its own resolvers with DNSSEC validation, check it before Saturday: a resolver that does not trust KSK-2024 will stop resolving healthy domains, and you will experience it as a general internet outage.

A 3-millisecond micro-outage left a European Google Cloud zone without service for almost 15 hours
Google Cloud published on July 25 the report on the incident that on July 15 interrupted several services in the europe-west4-a zone.