The DNS Root Switched to KSK-2024 on October 11: Which Resolvers Still Need a Manual Check

The key that changed on October 11

The DNS root zone now signs with a single new key. On October 11, 2026, the root stopped using its old key-signing key, KSK-2017, and began signing the root's public key set with KSK-2024 alone. It is the second time this has happened, after the first root KSK rollover in October 2018.

The new key carries key tag 38696. The old one carried key tag 20326.

Almost nobody has to do anything about it. Website owners, hosting customers and anyone whose domain uses Cloudflare for DNS are unaffected, and Cloudflare says its own systems, including 1.1.1.1 and Gateway DNS, already trust the new key. The work falls to the people running a DNSSEC-validating resolver: the software that checks DNS signatures on behalf of a group of users, whether that is an internet provider, a university, a company network or a self-hosted home setup.

For that group the failure mode is harsh. ICANN's guidance states that a validating resolver without KSK-2024 configured will experience total DNS resolution failures, cutting off internet access for its users. The resolver cannot validate the root's key set, so it cannot validate anything under the root, and the root sits above every top-level domain.

Where the key has to be

Trust anchors live in files that ship with the resolver software. ICANN names the three files administrators should check:

• ISC BIND: bind.keys
• Unbound and PowerDNS Recursor: root.key
• Knot Resolver: root.keys

The check is whether key tag 38696 appears in that file. If it does not, ICANN's next step is to verify that automatic trust updates are switched on and that the resolver can write to its own storage directory, because both conditions are needed before the software can add a key on its own.

That write-permission detail catches people out. A resolver told to learn new root keys automatically will still fail to keep one if it cannot save it, and the failure stays invisible until the key is needed.

Asking the resolver directly

RFC 8509 makes readiness testable instead of a matter of reading configuration files and hoping. It defines a root key trust anchor sentinel: ordinary DNS queries against specially named domains, answered differently depending on whether the resolver trusts a given root key.

Cloudflare runs a readiness test at dnstest.dev/ksk-2024. It sends two queries that ask opposite questions. The name is-ta-38696 asks whether the key is trusted, and not-ta-38696 asks whether it is not trusted. Both names have valid DNSSEC-signed address records, so a resolver that supports the sentinel validates the record first and then either returns the answer or replaces it with SERVFAIL.

The expected results are inverted between the two names. When KSK-2024 is trusted, the "is trusted" name returns a valid response and the "not trusted" name returns SERVFAIL. When the key is not trusted, that flips. A SERVFAIL on the "not trusted" name is a pass, which is the part of the design most likely to be misread.

Sentinel labels use the form root-key-sentinel-is-ta-38696 and work under any DNSSEC-signed domain; Cloudflare's test uses dnstest.dev. The page also checks that an ordinary signed name resolves and that a deliberately invalid DNSSEC name is rejected, which separates a meaningful answer from a lookup that failed for an unrelated reason. If sentinel support cannot be established at all, Cloudflare calls the result inconclusive. A browser test also checks only the resolver that browser uses, and Secure DNS or a VPN changes which one that is.

Why the root key is the hard case

DNSSEC lets a resolver check the signatures on DNS records and confirm that the answers it returns are genuine. Verifying a signature is only half of the job; the resolver also has to establish that the public key behind it belongs to the right domain. The chain of trust does that work.

For a domain such as cloudflare.com, the chain runs from the root to .com and then to cloudflare.com. Each parent publishes a Delegation Signer record holding a fingerprint of its child's public key, so .com publishes the DS record that lets a resolver check cloudflare.com's key.

The root has no parent to vouch for it. Instead, the resolver starts with a root public key, or its fingerprint, that it already trusts. That starting value is the trust anchor, and it is the one link in the chain that has to be distributed and maintained by hand or by a built-in default rather than looked up.

The root's keys split the signing work. The zone-signing key signs the root's own records, including the DS records for top-level domains. The key-signing key signs the list of public keys the root publishes. A resolver uses its trusted KSK to verify that list, then takes the ZSK from the list to verify everything else the root signs.

Cloudflare's earlier write-ups on the .de and .al rollover failures show the practical consequence: sites can be running normally and still be unreachable, because the failure is in validation rather than in serving.

Why most resolvers learned the key on their own

RFC 5011 lets a resolver pick up a new root trust anchor without an administrator touching it. The root publishes the replacement key next to the existing one in its DNSKEY set, and the existing KSK keeps signing that set, so the resolver can use the key it already trusts to verify the record carrying the new one.

Acceptance is deliberately slow. The resolver waits at least 30 days, checking the root's signed DNSKEY records repeatedly, and the new key has to stay present throughout. After that wait, and after verifying the records once more, the resolver treats the new key as a trust anchor.

That is why the calendar worked. KSK-2024 was first published in the root zone on January 11, 2025, which ICANN describes as the real start of this rollover. Resolvers with automatic updates had well over a year to observe it before the October 11 signing change, and ICANN reports that more than 95 percent of reporting resolvers have recognized and adopted the new key.

Automatic updates are still not something to assume. The 2018 rollover taught operators that resolvers can lose learned trust-anchor state during software upgrades or when they move between machines, which is why Cloudflare added KSK-2024 to its resolver's built-in trust anchors in July 2024 instead of relying on the learned copy.

What happens to the old key

The October switch changed which key signs the root's key set. It did not remove the old key from the system. ICANN plans to revoke KSK-2017, remove it from the root zone and delete its private key during 2027. Stopping a key from signing and removing trust in it are separate steps.

Two later changes are already on the table, and neither is part of this rollover. ICANN has proposed an algorithm rollover for the root to ECDSA P-256, which produces smaller keys and signatures than the RSA/SHA-256 that both KSK-2017 and KSK-2024 use. ECDSA is not a post-quantum algorithm. Separately, Cloudflare's 1.1.1.1 now validates ML-DSA-44 signatures, which are designed to resist attacks from quantum computers.

For DNSSEC to become post-quantum secure end to end, signed domains, their parent zones and the root all have to adopt post-quantum cryptography, and a post-quantum KSK at the root would need another rollover to distribute. Cloudflare's argument is that the routine key replacements in between are the rehearsal: they exercise trust-anchor distribution and let operators confirm that resolvers accepted the new key and retired the old one.