DNS root KSK rollover to KSK-2024 (key tag 38696) scheduled for Oct 11, 2026; unprepared DNSSEC resolvers risk outages
The DNS root zone is scheduled to switch its key-signing key (KSK) on October 11, 2026, only the second root KSK rollover ever. KSK-2024 (key tag 38696) will replace KSK-2017 (key tag 20326) as signer of the root DNSKEY set. DNSSEC-validating resolvers that do not trust the new key could fail validation and make healthy websites under any…