On October 11, 2026, the DNS root's key-signing key will change for only the second time, requiring validating resolvers to trust the new key (KSK-2024) beforehand to maintain DNSSEC authentication and prevent websites from becoming unreachable. Most website operators need not act, but those running DNSSEC-validating resolvers should verify they trust KSK-2024; Cloudflare users are already protected.