On October 11, 2026, the DNS root's key-signing key will change for only the second time, requiring validating resolvers to trust the new key (KSK-2024) beforehand to maintain DNSSEC authentication and prevent websites from becoming unreachable. Most website operators need not act, but those running DNSSEC-validating resolvers should verify they trust KSK-2024; Cloudflare users are already protected.
The DNS root key is scheduled to roll on 11 October 2026, requiring the old key to sign the new key and a 30-day hold-down period for resolvers to adopt it. RFC 5011 governs this process automatically, though measurement via RFC 8145 signals shows approximately 90% of reporting resolvers have already added the new KSK-2024 to their trust sets since its publication in July 2024.
The DNS Root Key is scheduled to roll on October 11, 2026, transitioning from the current KSK to KSK-2024, which was published in July 2024 and added to the root zone in January 2025. The article explains the technical process of root key rolling under RFC 5011, which requires a 30-day hold-down period for resolvers to learn and trust the new key, and describes measurement techniques using RFC 8145 signals to track which recursive resolvers have added the new key to their trust anchor set.