- The root zone KSK rollover took place on October 11, the second time since the first one nearly a decade ago.
- The update requires no action from website owners and regular users. Only those who run their own DNS resolver need to take action by making sure the resolver recognizes and trusts the new key, KSK-2024, with key tag 38696.
- A resolver that misses the new key can make healthy websites look dead.
The internet changed one of its most important security keys on October 11. ICANN, which manages the DNS root, announced that it will be swapping out the old Key Signing Key, KSK-2017, for this new one: KSK-2024. This is only the second time they’ve ever done it, so it’s a pretty rare event. The first was in 2018.
What Actually Changed
DNS is like the internet’s address book; it takes web names like example.com and turns them into numbers computers use to find each other. To keep things secure, there’s something called DNSSEC, a system that checks if the answers you get from DNS are legit and aren’t messed with in transit.
DNSSEC basically builds a chain of trust. Every link is signed by the one above it. At the very top sits the root zone, and the root’s Key Signing Key, or KSK, anchors the whole chain.
On October 11, the club began signing with KSK-2024 instead of KSK-2017. The new key has been published in the root zone since January 11, 2025. That head start gave operators time to pick it up.
The root KSK rollover is a crucial aspect of maintaining DN security and keeping it resilient against attacks, according to Kim Davies, VP of IANA Services and the president of PTI. ICANN details all the things to expect during the rollover in a July 27 disclosure document.
A Bad Update is Detrimental
A resolver that checks DNSSEC must trust the new key. If it keeps trusting just the old key, it can’t check the root’s signatures anymore. So, it starts doubting the answers it gets and ends up throwing an error.
The damage is wide. Akamai warns that such a resolver may fail on signed and unsigned domains alike. Cloudflare says affected users may be unable to reach sites under any top-level domain.
Here is the cruel part. Your servers can run perfectly while visitors behind a broken resolver still cannot reach your site.
Who does the Latest Change Concern the Most?
Cloudflare says most website operators do not need to change anything. Its own DNS services, including 1.1.1.1, already trust KSK-2024. The company built the new key into its resolver software in July 2024.
The people at risk are those who run validating resolvers. That includes internet service providers, companies running their own DNS servers, and all sorts of gear like firewalls or load balancers that have a built-in resolver.
Older software and hand-set trust keys carry the most risk. These days, most modern resolvers handle key updates on their own. They use something called RFC 5011, which basically waits 30 days after spotting a new key before deciding it’s safe to trust. Adoption jumped after February 10, 2025, once that wait ended.
Misconfigured systems and weak security practices can create other risks, too. A recent report found that 768 leaked AWS keys remained active, including 526 with root access. ICANN does not want operators to assume it worked. Its guidance says to check the trusted keys directly rather than trust the automatic update.
How to Check
Start with your trust anchor file. Look for key tag 38696. If you’re checking your resolver, look for files named bind.keys for BIND, root.key for Unbound and PowerDNS Recursor, and root.keys for Knot Resolver.
If the new key’s missing, make sure automatic updates are on, and your software can actually write to the folder where it keeps its keys. Then follow your vendor’s steps to add it by hand.
A file on disk is not proof, though. Akamai advises checking that the running program actually loaded the key. Commands such as rndc managed-keys status in BIND can show this.
You can also run a test. Cloudflare offers a readiness check at dnstest.dev/ksk-2024. A second option is the RFC 8509 sentinel test. Look up two special names: one with “root-key-sentinel-is-ta-38696” and another with “root-key-sentinel-not-ta-38696”.
If you get a response for the first but not the second, it means your resolver trusts the new key. If both resolve, the result is inconclusive, not a pass. Run it from each network that depends on a resolver. A VPN can skew results.
Lessons from 2018 Rollover
The first rollover was planned for October 2017. ICANN delayed it a year after odd signals suggested many resolvers were not ready. It finished in October 2018.
Researchers Duane Wessels and Roy Arends say the trouble that did occur came from unprepared or misconfigured systems. The mechanism itself worked. They also note that adoption of the new key looked nearly the same in both rollovers. After about 500 days, more than 95% of sampled resolvers trusted the incoming key.
Cloudflare drew its own lesson. It stopped relying on resolvers to learn the key and built it into its software.
What’s Next
This is not the last step. KSK-2017 stays trusted for now. ICANN plans to retire it in early 2027, with January 11 given as the target date. After that, the old key is declared invalid, removed and its private key destroyed.
SIDN, the Dutch registry, says another rollover is planned for 2029. That one would change both the key and the math behind it. The goal is a three-year cycle. Cloudflare adds that this change does not bring post-quantum cryptography. That would need its own rollover.
For now, the job is simple. If you run a validating resolver, look at your trusted keys today. If you do not, your DNS provider has likely done the work for you.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Florida Sues TP-Link Over Router Security Risks and Alleged China Links
Florida’s Attorney General James Uthmeier sued TP-Link, saying the company hid risks tied to i...
Microsoft Warns Hackers are Using AI to Speed Up Cyberattacks
Microsoft declared that threat actors are presently reaping AI advantages at a faster pace with rega...
Signal Expands Encrypted Backups and Private iPhone Transfers in Version 8.30
Signal version 8.30 adds on-device backups to iOS and Signal Desktop. The update separates media fil...
Hacker Claims 4.5 Million Records Linked to Italian Hotel Software Firm WuBook Leaked
An underground forum user says they leaked 4.5 million names and IDs tied to WuBook, an Italian hote...
Armenian Ryuk Ransomware Hacker Sentenced to 2 Years in US Prison
Armenian national Karen Vardanyan received 24 months in prison and three years of supervised release...
Leaked EU Draft Could Let AI Companies Use Personal Data Without Consent
A leaked EU document could let AI companies use personal data without your consent. The draft remove...
