The DNS root key is scheduled to roll on 11 October 2026, requiring the old key to sign the new key and a 30-day hold-down period for resolvers to adopt it. RFC 5011 governs this process automatically, though measurement via RFC 8145 signals shows approximately 90% of reporting resolvers have already added the new KSK-2024 to their trust sets since its publication in July 2024.
The DNS Root Key is scheduled to roll on October 11, 2026, transitioning from the current KSK to KSK-2024, which was published in July 2024 and added to the root zone in January 2025. The article explains the technical process of root key rolling under RFC 5011, which requires a 30-day hold-down period for resolvers to learn and trust the new key, and describes measurement techniques using RFC 8145 signals to track which recursive resolvers have added the new key to their trust anchor set.