---
title: "The keys to the Internet change on October 11. Are you ready?"
description: "On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch."
---

# The keys to the Internet change on October 11. Are you ready?

[Cloudflare](https://yomu.fyi/company/cloudflare) · James Godlewski · Oct 6, 2026

**Type:** Announcement

## Summary

On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.

## Context

Cloudflare explains the upcoming October 11, 2026 root KSK rollover, the second in DNSSEC history, and how resolvers can test readiness using RFC 8509 sentinels.

## Approach / What changed

Cloudflare added KSK-2024 to its resolver’s built-in trust anchors in July 2024 and uses RFC 8509 sentinel queries to let operators verify resolver trust in the new key before the rollover.

## Takeaways

- The root KSK rollover on October 11, 2026 replaces KSK-2017 with KSK-2024, and validating resolvers must trust the new key before the switch to avoid SERVFAIL.
- RFC 8509 sentinel queries let users ask a resolver whether it trusts a specific root key; Cloudflare’s dnstest.dev provides a readiness test.
- Resolvers that support RFC 5011 can learn the new trust anchor automatically, but operators should verify their resolver trusts KSK-2024 ahead of the rollover.

## FAQ

### Do I need to do anything for the October 11, 2026 root KSK rollover?

Most website operators do not need to make any changes. If you run a DNSSEC-validating resolver, check that it trusts the new root key KSK-2024 and follow your software vendor’s instructions to update trust anchors if the key is missing. Cloudflare DNS users need no action.

### How can I check if my resolver trusts the new root key?

Use the RFC 8509 root key trust anchor sentinel. Query names like is-ta-38696.dnstest.dev and not-ta-38696.dnstest.dev; a supporting resolver returns a valid answer for the trusted key and SERVFAIL for the untrusted one. Cloudflare’s dnstest.dev provides this test.

### What happens if a resolver does not trust the new key?

If a validating resolver does not trust KSK-2024, it may return SERVFAIL for DNSSEC-signed domains, making healthy websites unreachable. The rollover includes a 30-day waiting period for resolvers to learn the new key via RFC 5011, but operators should verify readiness.

**Tags:** [Cloudflare](https://yomu.fyi/topic/cloudflare), [DNS](https://yomu.fyi/topic/dns), [DNSSEC](https://yomu.fyi/topic/dnssec), [Root KSK Rollover](https://yomu.fyi/topic/root-ksk-rollover)

- Source: [Cloudflare](https://blog.cloudflare.com/root-ksk-2024-rollover)
- Source URL: https://blog.cloudflare.com/root-ksk-2024-rollover
- Ingested by Yomu: 2026-10-06T18:00:08.394Z

[Read original post](https://blog.cloudflare.com/root-ksk-2024-rollover)