---
title: "Root KSK Rollover"
description: "1 posts about Root KSK Rollover, summarised, each linking to the original."
---

# Root KSK Rollover
> 1 posts about Root KSK Rollover, summarised, each linking to the original.

## Articles

### [The keys to the Internet change on October 11. Are you ready?](https://yomu.fyi/post/the-keys-to-the-internet-change-on-october-11-are-you-ready.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: James Godlewski
- Published: Oct 6, 2026
- Type: Announcement

On October 11, 2026, the DNS root will replace its DNSSEC key-signing key (KSK) for only the second time, moving from KSK-2017 to KSK-2024. The rollover changes the trust anchor that validating resolvers use to verify the root’s DNSKEY records. Cloudflare has published KSK-2024 in the root’s DNSKEY set since January 11, 2025, and added it to its own resolver’s built-in trust anchors in July 2024. To help operators check readiness, Cloudflare uses RFC 8509 root key trust anchor sentinels, which let a resolver report whether it trusts a given key. Most website operators need no action, but DNSSEC-validating resolvers should confirm they trust KSK-2024 before the switch.