CloudflareJames GodlewskiAnnouncement
On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.
Cloudflare explains the upcoming October 11, 2026 root KSK rollover, the second in DNSSEC history, and how resolvers can test readiness using RFC 8509 sentinels.
Cloudflare added KSK-2024 to its resolver’s built-in trust anchors in July 2024 and uses RFC 8509 sentinel queries to let operators verify resolver trust in the new key before the rollover.
The root KSK rollover on October 11, 2026 replaces KSK-2017 with KSK-2024, and validating resolvers must trust the new key before the switch to avoid SERVFAIL.
RFC 8509 sentinel queries let users ask a resolver whether it trusts a specific root key; Cloudflare’s dnstest.dev provides a readiness test.
Resolvers that support RFC 5011 can learn the new trust anchor automatically, but operators should verify their resolver trusts KSK-2024 ahead of the rollover.
Most website operators do not need to make any changes. If you run a DNSSEC-validating resolver, check that it trusts the new root key KSK-2024 and follow your software vendor’s instructions to update trust anchors if the key is missing. Cloudflare DNS users need no action.
Use the RFC 8509 root key trust anchor sentinel. Query names like is-ta-38696.dnstest.dev and not-ta-38696.dnstest.dev; a supporting resolver returns a valid answer for the trusted key and SERVFAIL for the untrusted one. Cloudflare’s dnstest.dev provides this test.
If a validating resolver does not trust KSK-2024, it may return SERVFAIL for DNSSEC-signed domains, making healthy websites unreachable. The rollover includes a 30-day waiting period for resolvers to learn the new key via RFC 5011, but operators should verify readiness.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
The Branded Calling trust chain, layer by layer: how identity, STIR/SHAKEN attestation, Rich Call Data, and carrier delivery combine so a verified brand name reaches the recipient's screen.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
