The keys to the Internet change on October 11. Are you ready?
On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024).
On October 11, 2026, the DNS root switches to a new key-signing key (KSK-2024).
The short version
- Learn what this means for you, and how RFC 8509 trust anchor sentinels allow you to test whether your DNS resolver is ready for the rollover.
- On October 11, 2026, the DNS root is scheduled to change its key-signing key (KSK) for only the second time ever.
- This key anchors DNSSEC’s chain of trust, which lets DNS resolvers authenticate answers using cryptographic signatures.
What happened
The change is called a KSK rollover. Validating resolvers need to trust the new key before the switch, as otherwise healthy websites could become unreachable.
Why it matters
When we wrote about the first root KSK rollover in 2018 , we had seen resolvers lose their learned trust in the new key during software upgrades or moves between machines.
Summary by Nerd News Network. Read the full article at Cloudflare Blog via the links above and below.