NEWS 
DNSSEC Key Successfully Rolled Over in the Internet Root Zone
On October 11, 2026, the planned rollover of the Key Signing Key (KSK) for the Domain Name System (DNS) root zone took place. The new KSK-2024 key began signing the root zone, replacing the previous KSK-2017 key. The update was announced by ICANN and the Internet Assigned Numbers Authority (IANA).
The root key rollover is an important measure for maintaining the security, stability, and resilience of the global domain name system. The KSK plays a key role in DNSSEC, enabling the validation of DNS data and protecting it against tampering.
The new KSK-2024 key has the key tag 38696. It was published in advance to allow operators of DNS resolvers that support DNSSEC validation to update their trust settings and prepare their systems for the transition.
According to ICANN, the new key began being used as scheduled at 14:00 UTC on October 11, 2026. ICANN reported no signs of widespread infrastructure disruption associated with the rollover at the time of publication, while continuing to monitor the situation.
Operators of DNS resolvers are advised to verify that the new key is present in their trust anchor configuration. If the required key is missing, DNSSEC validation failures and domain name resolution problems may occur.
The planned KSK rollover is part of ongoing efforts to maintain the cryptographic security of DNS and ensure the reliable operation of the global Internet infrastructure.
Further information:
