The DNS root changes its signing key on 11 October
Cloudflare warns that DNSSEC-validating resolvers which have not adopted KSK-2024 could stop resolving entire top-level domains. A free sentinel test checks readiness.
On 11 October 2026 the DNS root retires KSK-2017 (key tag 20326) as the signer of its DNSKEY set and replaces it with KSK-2024. Cloudflare detailed the change on 6 October — it’s only the second root key-signing-key rollover ever, after 2018; this one was delayed by pandemic disruption and hardware upgrades to the signing ceremony’s HSMs.
The KSK anchors DNSSEC’s chain of trust: resolvers use it to verify the root’s published keys before trusting anything signed beneath them. KSK-2024 has been published alongside KSK-2017 since January 2025, so most validating resolvers have already picked it up automatically. But any resolver that hasn’t — because it’s pinned an old trust anchor or missed an update — will start failing validation once KSK-2017 is withdrawn, and its users “may be unable to reach websites under any top-level domain,” even though the sites themselves are fine. Cloudflare’s own 1.1.1.1 and Gateway DNS already trust KSK-2024, so customers there don’t need to do anything.
To check a resolver, Cloudflare built an RFC 8509 trust anchor sentinel test at dnstest.dev/ksk-2024, or you can run it by hand:
dig @1.1.1.1 root-key-sentinel-is-ta-38696.dnstest.dev. A
dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. AA resolver that trusts KSK-2024 returns records for the first query and SERVFAIL for the second.
Why it matters: if you run your own DNSSEC-validating resolver rather than relying on a public one, test it before the 11th. This isn’t a single-site outage risk — a resolver stuck on the old key can take down lookups for an entire TLD for everyone behind it.