/
← Voltar ao feed
medium

DNS root KSK rollover to KSK-2024 (key tag 38696) scheduled for Oct 11, 2026; unprepared DNSSEC resolvers risk outages

1 fonte(s) · 1 atualização(ões) · publicado 06/10/2026 14:50 · coletado há 2 dias

The DNS root zone is scheduled to switch its key-signing key (KSK) on October 11, 2026, only the second root KSK rollover ever. KSK-2024 (key tag 38696) will replace KSK-2017 (key tag 20326) as signer of the root DNSKEY set. DNSSEC-validating resolvers that do not trust the new key could fail validation and make healthy websites under any top-level domain unreachable. Cloudflare states that 1.1.1.1, Gateway DNS and its authoritative DNS already trust KSK-2024, and it has published a readiness test based on RFC 8509 trust anchor sentinels.

Detalhes técnicos

  • KSK-2024 has been published in the root DNSKEY set since January 11, 2025. Resolvers using RFC 5011 automatic updates wait at least 30 days and must re-verify the key before accepting it as a trust anchor.
  • Cloudflare added KSK-2024 to its resolver's built-in trust anchors in July 2024. During the 2018 rollover, some resolvers lost learned trust-anchor state after software upgrades or moves between machines.
  • RFC 8509 sentinel check: the names root-key-sentinel-is-ta-38696 and root-key-sentinel-not-ta-38696 can be queried under any DNSSEC-signed domain (Cloudflare uses dnstest.dev). A supporting resolver that trusts KSK-2024 answers the is-ta name and returns SERVFAIL for the not-ta name. If sentinel support cannot be established, the result is inconclusive and does not mean the key is missing.
  • Both KSKs use RSA/SHA-256. ICANN plans to revoke KSK-2017, remove it from the root zone and delete its private key in 2027. ICANN has also proposed a future algorithm rollover to ECDSA P-256, separate from this event. 1.1.1.1 now validates ML-DSA-44 signatures, and a post-quantum root KSK would require another rollover.

Remediação

  • Operators of DNSSEC-validating resolvers should confirm that KSK-2024 (key tag 38696) is trusted. If it is missing, they should follow ICANN's guidance and their software vendor's instructions to update trust anchors.
  • Test resolver readiness at https://dnstest.dev/ksk-2024. The browser result reflects the resolver in use, which may be affected by Secure DNS or a VPN.
  • Most website operators need no action. DNS providers and resolver developers are encouraged to support RFC 8509 sentinels.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 06/10/2026 14:50 · coletado 19/10 18:00 primeiro registro

    DNS root KSK rollover to KSK-2024 (key tag 38696) scheduled for Oct 11, 2026; unprepared DNSSEC resolvers risk outages

    ler a análise desta fonte

    The DNS root zone is scheduled to switch its key-signing key (KSK) on October 11, 2026, only the second root KSK rollover ever. KSK-2024 (key tag 38696) will replace KSK-2017 (key tag 20326) as signer of the root DNSKEY set. DNSSEC-validating resolvers that do not trust the new key could fail validation and make healthy websites under any top-level domain unreachable. Cloudflare states that 1.1.1.1, Gateway DNS and its authoritative DNS already trust KSK-2024, and it has published a readiness test based on RFC 8509 trust anchor sentinels.

    Technical Details

    • KSK-2024 has been published in the root DNSKEY set since January 11, 2025. Resolvers using RFC 5011 automatic updates wait at least 30 days and must re-verify the key before accepting it as a trust anchor.
    • Cloudflare added KSK-2024 to its resolver's built-in trust anchors in July 2024. During the 2018 rollover, some resolvers lost learned trust-anchor state after software upgrades or moves between machines.
    • RFC 8509 sentinel check: the names root-key-sentinel-is-ta-38696 and root-key-sentinel-not-ta-38696 can be queried under any DNSSEC-signed domain (Cloudflare uses dnstest.dev). A supporting resolver that trusts KSK-2024 answers the is-ta name and returns SERVFAIL for the not-ta name. If sentinel support cannot be established, the result is inconclusive and does not mean the key is missing.
    • Both KSKs use RSA/SHA-256. ICANN plans to revoke KSK-2017, remove it from the root zone and delete its private key in 2027. ICANN has also proposed a future algorithm rollover to ECDSA P-256, separate from this event. 1.1.1.1 now validates ML-DSA-44 signatures, and a post-quantum root KSK would require another rollover.

    Remediation

    • Operators of DNSSEC-validating resolvers should confirm that KSK-2024 (key tag 38696) is trusted. If it is missing, they should follow ICANN's guidance and their software vendor's instructions to update trust anchors.
    • Test resolver readiness at https://dnstest.dev/ksk-2024. The browser result reflects the resolver in use, which may be affected by Secure DNS or a VPN.
    • Most website operators need no action. DNS providers and resolver developers are encouraged to support RFC 8509 sentinels.