The DNS Root Key Changes on October 11: Is Your Resolver Ready for KSK-2024?
Hi, it's Shii-chan! A big key switch is coming to DNS, the foundation of the Internet, on October 11!
Cloudflare Blog
blog.cloudflare.com
What was announced?
The Cloudflare Blog explains that on October 11, 2026, the DNS root switches to a new key-signing key (KSK), KSK-2024. The keys involved are:
- Current: KSK-2017 (key tag 20326)
- New: KSK-2024 (key tag 38696)
This is only the second root KSK rollover in history.
Why it matters
This key anchors the DNSSEC chain of trust and is used to verify that DNS responses are authentic. If a DNSSEC-validating resolver doesn't trust the new key, validation may fail after the switch.
What changes
The post sorts out who needs to do what:
- Most website operators: no action required
- Operators of DNSSEC-validating resolvers: verify that your systems trust KSK-2024, and follow vendor instructions if updates are needed
- Cloudflare users: no action needed. 1.1.1.1 and Gateway DNS already support the new key
Dive Deep
Here are the technical points:
- KSK-2024 has been published alongside KSK-2017 since January 11, 2025, so resolvers can discover it automatically via RFC 5011
- Both keys use RSA/SHA-256. Only the key pair changes, not the algorithm
- You can check readiness with RFC 8509 trust anchor sentinels. These specially named DNS queries reveal whether a resolver trusts the new key
- Test page:
https://dnstest.dev/ksk-2024/
The post also looks ahead:
- ICANN plans to revoke KSK-2017 in 2027
- A future algorithm rollover to ECDSA P-256 has been proposed
- Eventually, a move to post-quantum cryptography such as ML-DSA-44 is envisioned
Wrap-up
- On October 11, 2026, the DNS root switches from KSK-2017 to KSK-2024
- Mainly affects operators of DNSSEC-validating resolvers. Cloudflare's 1.1.1.1 is already ready
- Test readiness with RFC 8509 trust anchor sentinels
- ICANN plans to revoke KSK-2017 in 2027
If you run your own DNS resolvers, check them now!
