Curated
Importance:
Medium
The DNS root changes its signing key on October 11: what resolvers should check
On October 11, 2026 the DNS root replaces the KSK-2017 key with KSK-2024, for only the second time in its history. Anyone running a resolver that validates DNSSEC should confirm it already trusts the new one.
If your company uses the resolvers of its operator or a large public provider, you do not need to do anything. If it runs its own resolvers with DNSSEC validation, check it before Saturday: a resolver that does not trust KSK-2024 will stop resolving healthy domains, and you will experience it as a general internet outage.
