The DNS root zone will begin signing with a new key-signing key on Oct. 11, retiring the key that has anchored DNSSEC validation since 2018, Cloudflare said in a blog post Tuesday. The company urged operators of DNSSEC-validating resolvers to confirm they trust the new key, known as KSK-2024, or risk users being unable to reach otherwise healthy websites.

What Happened

On Oct. 11, KSK-2024, with key tag 38696, replaces KSK-2017, with key tag 20326, as the key that signs the root zone's DNSKEY set. It is only the second time the root key-signing key has been rolled since DNSSEC was deployed at the root. Both keys use the RSA/SHA-256 algorithm, so the cryptographic method stays the same and only the key pair changes.

The new key is not a surprise. KSK-2024 has been published in the root zone since Jan. 11, 2025, giving software vendors and operators time to add it as a trust anchor. Cloudflare said it added KSK-2024 to the built-in trust anchors of its 1.1.1.1 public resolver in July 2024, so users of 1.1.1.1 and Cloudflare Gateway DNS, as well as customers of Cloudflare's authoritative DNS, do not need to do anything.

RelatedGermany's BSI Urges Small Plant Operators to Take Controllers Offline After French Fridge Attack

The rollover does not end with the switch. ICANN plans to revoke KSK-2017, remove it from the root zone and destroy its private key during 2027.

Why It Matters

The root key-signing key sits at the top of DNSSEC's chain of trust. A validating resolver checks signatures on DNS answers by following that chain back to a trust anchor it already holds. If a resolver trusts only KSK-2017 when the root starts signing with KSK-2024, the chain breaks at the top, and the resolver can fail to resolve names under any top-level domain, even though the sites themselves are working normally.

The risk is concentrated in organizations that run their own validating resolvers, such as internet service providers, enterprises and universities. Website owners generally do not need to change anything.

Cloudflare's post did not include measurements of how many resolvers on the internet are not yet ready.

Lessons From 2018

The first root KSK rollover was originally scheduled for October 2017 but was postponed for a year after data showed that a meaningful share of resolvers did not yet trust the new key. It was completed on Oct. 11, 2018.

Cloudflare said that experience showed resolvers losing trust-anchor state they had learned automatically when software was upgraded or moved to new machines. That is why the industry has favored shipping KSK-2024 in default software configurations, and why Cloudflare told operators to make sure the new anchor survives upgrades and migrations rather than assuming it was picked up once.

How to Check

Cloudflare pointed operators to trust-anchor sentinels defined in RFC 8509, which use specially named DNS queries to reveal whether a resolver trusts a given key. A query for a name labeled is-ta-38696 should resolve normally on a ready resolver, while one labeled not-ta-38696 should return a SERVFAIL error. Operators can run the test in a browser at dnstest.dev/ksk-2024/ or with the dig command-line tool, and should follow their resolver vendor's guidance if the key is missing.

What to Watch

The signing switch takes place Sunday, Oct. 11. Any resolution failures tied to the change would most likely surface at networks running older or customized validating resolvers. The next milestone is the revocation and removal of KSK-2017 in 2027.