Summary
Cloudflare warned on October 6, 2026 that the DNS root's key-signing key changes to KSK-2024 on October 11, only the second root KSK rollover ever. The new key begins signing the root on October 11 and the old key is retired in January 2027; most website operators need no action, but operators of validating resolvers should confirm their automated trust-anchor (RFC 5011) updates are working.
What changed
The DNSSEC root zone's key-signing key rolls over to KSK-2024, which starts signing the root on October 11, 2026, with the previous key scheduled for revocation on January 11, 2027. RFC 8509 trust-anchor sentinels let operators test whether their resolver already trusts the new key.
Why it matters
DNSSEC anchors the chain of trust for authenticated DNS; a validating resolver that fails to pick up KSK-2024 can break DNS resolution for its users after the rollover. It is a rare internet-wide trust event that resolver and infrastructure operators must verify readiness for.
Evidence excerpt
The DNS root is set to change its key-signing key for only the second time; the new key, KSK-2024, starts signing the root on October 11.