Topic

Root KSK Rollover

1 post about Root KSK Rollover. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Cloudflare
The keys to the Internet change on October 11. Are you ready?
On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.

The best engineering reads, once a week.

Topic

1 post about Root KSK Rollover. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Cloudflare
The keys to the Internet change on October 11. Are you ready?
On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.

The best engineering reads, once a week.