---
title: "DNSSEC"
description: "2 posts about DNSSEC, summarised, each linking to the original."
---

# DNSSEC
> 2 posts about DNSSEC, summarised, each linking to the original.

## Articles

### [The keys to the Internet change on October 11. Are you ready?](https://yomu.fyi/post/the-keys-to-the-internet-change-on-october-11-are-you-ready.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: James Godlewski
- Published: Oct 6, 2026
- Type: Announcement

On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.


### [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it](https://yomu.fyi/post/1-1-1-1-now-supports-post-quantum-dnssec-all-2-420-bytes-of-it.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Sebastiaan Neuteboom
- Published: Sep 10, 2026
- Type: Announcement

1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a NIST-standardized post-quantum algorithm, as an initial step toward post-quantum DNSSEC. The operational problem is that each signature is 2,420 bytes—almost 38 times an ECDSA P-256 signature and larger than common DNS-over-UDP limits—while zones must continue publishing conventional signatures for older resolvers. Cloudflare’s resolver handles this by testing larger responses at Internet scale, relying on truncation and transport retries rather than fragmented UDP, and using authenticated DS records to require a valid post-quantum path when a zone advertises one, preventing downgrade to conventional validation. The change provides operational experience for an ecosystem migration that requires coordination across DNS participants; Cloudflare says it plans full post-quantum security by 2029.