IANA switches the DNS root zone to new signing key KSK-2024
in plain words
The internet's address book for domain names uses a special key to prove its answers are genuine. On 11 October 2026, that key was replaced with a new one. Most people should not notice, but some older computers and routers may fail to load websites or email.
Full summary
The root zone The top of the DNS, listing every TLD and its name servers. Full definition of root zone began signing with a new key signing key, KSK-2024, on 11 October 2026, and IANA Internet Assigned Numbers Authority The functions that coordinate the root zone, IP addresses and protocol numbers. Full definition of IANA confirmed the changeover the same day. No major disruptions had been publicly reported. resolver The DNS server that looks up domain names on behalf of users. Full definition of resolver may keep the old key list in their cache for up to two days, so problems in systems that have not updated could appear later.
The new key carries key tag 38696 and replaces the previous key. IANA says most users should notice nothing. Resolvers that do not recognize the new key could fail DNSSEC validation A resolver's check that a DNS answer is correctly signed with DNSSEC. Full definition of DNSSEC validation. The root key list is now signed by KSK-2024 and is valid from 00:00 UTC on 11 October, while the older KSK-2017, key tag 20326, remains listed without signing it. Google and Cloudflare public resolvers validated answers successfully, although Google still served a cached version signed by KSK-2017.
Operators on the DNS-OARC DNS Operations, Analysis, and Research Center The body that brings DNS operators and researchers together, known for its OARC workshops. Full definition of DNS-OARC dns-operations mailing list had posted no reports about the changeover by Tuesday morning. Some individual failures appeared elsewhere. On 12 October, an administrator in the Zimbra forum reported outages on servers running Ubuntu 22.04 or older that validate DNSSEC Domain Name System Security Extensions Digital signatures that prove DNS answers are genuine and unchanged. Full definition of DNSSEC, saying signed domains had not resolved since Sunday and email was stuck. A user in the ASUS forum said the router firmware knew only the old key, so name resolution failed when validation was enabled.
The previous root key change took place on 11 October 2018. ICANN Internet Corporation for Assigned Names and Numbers The nonprofit that coordinates the global DNS and gTLD policy. Full definition of ICANN reported minor disruptions four days later and said quick fixes resolved them. The old KSK-2010 was revoked in 2019. A further rollover is planned and will also change the signing algorithm. ICANN proposed this in February and intends to implement it unchanged, generating a new ECDSA key in 2027, with the current RSA key expiring in 2029.