---
id: "key-rollover"
kind: "glossary-term"
title: "key rollover"
language: "en"
category: "DNS and technical foundations"
updated: "2026-10-08T09:43:54Z"
canonical: "https://tldlog.com/glossary/key-rollover/"
translations:
  es: "https://tldlog.com/es/glosario/traspaso-clave/"
  de: "https://tldlog.com/de/glossar/key-rollover/"
  fr: "https://tldlog.com/fr/glossaire/roulement-cle/"
  it: "https://tldlog.com/it/glossario/rollover-chiave/"
  pt-BR: "https://tldlog.com/pt/glossario/substituicao-chave/"
  ru: "https://tldlog.com/ru/glossariy/smena-klyucha/"
  zh-Hans: "https://tldlog.com/zh/cihui/miyao-lunzhuan/"
---

# key rollover

The planned replacement of a DNSSEC key with a new one. It is done in careful steps so that resolvers always have a key they can use to check signatures. A mistake can make a domain unreachable. Changing the root zone's key is a rare, closely watched event.

## related terms

- [KSK](https://tldlog.com/glossary/ksk/)
- [ZSK](https://tldlog.com/glossary/zsk/)
- [trust anchor](https://tldlog.com/glossary/trust-anchor/)
- [DS record](https://tldlog.com/glossary/ds-record/)
- [CDS and CDNSKEY](https://tldlog.com/glossary/cds-cdnskey/)