DNS Root Key Rollover: What KSK-2024 Means for Resolvers

The DNS root key rollover scheduled for October 11, 2026 is one of the quietest important events on the internet. On this date, according to ICANN, the root zone begins using only a new cryptographic key, called KSK-2024, to anchor DNSSEC. It is only the second time the root's key-signing key has ever been replaced. For almost everyone, nothing visible changes, and that is the sign of a well-run security process.

• What changes: KSK-2024 (key tag 38696) replaces KSK-2017 (key tag 20326) as the signer of the root's key set.
• When: scheduled for October 11, 2026, per ICANN.
• Readiness: more than 95 percent of reporting resolvers had adopted the new key by July, ICANN says.
• Who needs to act: only operators of DNSSEC-validating resolvers, who should confirm key tag 38696 is in their trust anchors.

What Is the Root Key-Signing Key?

DNSSEC lets a resolver verify that a DNS answer is authentic and was not altered on the way. Each zone's signatures are vouched for by the zone above it, forming a chain. The chain has to start somewhere, and it starts at the root.

Because the root has no parent to vouch for it, every validating resolver is configured in advance with the root's public key. That stored key is the trust anchor. The key-signing key, or KSK, is the root key that signs the list of root public keys. A resolver uses the KSK it trusts to check that list, then uses those keys to check everything below.

Replacing that key is simple good hygiene, in the same way that organizations rotate passwords and certificates. It limits how long any single key is exposed and proves the replacement process works before it is ever needed in an emergency. It is the same thinking behind Signal's automated key transparency checks: trust should be verifiable and renewable.

Why Is This Only the Second Rollover?

The first root KSK rollover took place in October 2018. ICANN had planned it for 2017 and postponed it by a year for more outreach after data showed many operators had not yet picked up the new key.

This time the runway was longer. ICANN's Roy Arends notes that KSK-2024 was first published in the root zone on January 11, 2025, giving resolvers well over a year to learn it. Cloudflare says it added the key to the built-in trust anchors of its 1.1.1.1 resolver in July 2024. Both keys use the same RSA/SHA-256 algorithm, so this rollover changes the key pair and nothing else.

"On 11 October 2026, the root zone will begin using only KSK-2024," Arends wrote in ICANN's July guidance.

What Should Resolver Operators Check?

If you use a public resolver or your provider's DNS, there is nothing to do. Cloudflare states that users of 1.1.1.1, its Gateway DNS and its authoritative DNS need no action.

If you run your own validating resolver, ICANN's advice is direct: "Do not assume automatic trust-anchor updates succeeded." Check the trust anchor file for key tag 38696:

• BIND: bind.keys
• Unbound and PowerDNS Recursor: root.key
• Knot Resolver: root.keys

If the key is missing, follow your resolver vendor's instructions to update it. Cloudflare also hosts a readiness test at dnstest.dev/ksk-2024 that reports whether the resolver you are using trusts the new key. At the time of writing I have not seen a post-event report from ICANN, so operators should verify their own systems instead of waiting for one.

What Comes Next for DNSSEC?

The old key is retired in stages. According to Cloudflare, ICANN plans to revoke KSK-2017, remove it from the root zone and delete its private key in 2027.

Further out, ICANN has proposed moving the root to ECDSA P-256, which uses smaller keys and signatures. And Cloudflare notes that 1.1.1.1 now validates ML-DSA-44 post-quantum signatures, although making the root itself post-quantum would take another rollover. That connects to wider work we covered in Cloudflare's post-quantum certificate plans.

Each rollover is practice for the next one. A smooth key change today makes the bigger cryptographic transitions ahead far less daunting. More in our security coverage.

Sources: ICANN — 11 October 2026 Root Zone KSK Rollover — October 2026; ICANN Blog — Preparing for the Root Zone KSK Rollover — July 27, 2026; Cloudflare Blog — Root KSK-2024 rollover — October 6, 2026.