JA EN
shiichan

Now you can check if a DNSSEC root key is trusted with one query!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I found a bit of a niche but genuinely important update to how DNS works under the hood.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, Cloudflare announced that its public DNS resolver, 1.1.1.1, now supports RFC 8509 root key trust anchor sentinels. This mechanism lets you check whether a resolver already trusts a specific DNSSEC root key (KSK, Key Signing Key) before that key goes through a rollover, just by querying a special domain name.

For example, if you want to check whether 1.1.1.1 trusts KSK-2024 (key tag 38696), you just run a dig command against a domain under dnstest.dev.

# If 1.1.1.1 trusts KSK-2024:
# Returns NOERROR with an A answer.
dig @1.1.1.1 root-key-sentinel-is-ta-38696.dnstest.dev. A +noall +comments +answer

# If it doesn't:
# Returns SERVFAIL without an answer.
dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +noall +comments +answer

# CD flag bypasses sentinel processing and returns the original A answer.
dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +cdflag +noall +comments +answer

Why it matters

DNSSEC periodically rolls the root key used to sign the root zone. Without a way to check ahead of time whether resolvers around the world actually trust the new key, a rollover could cause validation failures and break resolution for a lot of domains at once. Sentinel support gives operators and resolver developers a mechanical way to check, ahead of a rollover, whether a given resolver already has the new key.

What changes

If you operate DNS infrastructure or resolvers, you can now check the trust status of a root key like KSK-2024 right away, just by sending a sentinel query to 1.1.1.1. If you want to learn more about how DNSSEC validation works in general, Cloudflare's docs on DNSKEY are a good place to look.

Wrap-up

  • 1.1.1.1 now supports RFC 8509 root key trust anchor sentinels
  • Query a special domain name with dig to check whether a given DNSSEC root key is trusted
  • Test domains for KSK-2024 (key tag 38696) are available under dnstest.dev
  • Adding the CD flag bypasses sentinel processing
  • Useful for resolver operators and DNS-savvy engineers preparing for a root key rollover

Related posts