---
id: "42c79885-2bc1-48dc-ac0c-0815a1d83bef"
kind: "link"
title: "IANA switches the DNS root zone to new signing key KSK-2024"
language: "en"
section: "security"
date: "2026-10-14T07:20:43Z"
updated: "2026-10-14T07:20:43Z"
canonical: "https://tldlog.com/l/iana-switches-dns-root-zone-new-signing-key-ksk-2024/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/iana-cambia-zona-raiz-dns-nueva-clave-firma-ksk-2024/"
  de: "https://tldlog.com/de/l/iana-stellt-dns-root-zone-neuen-signierschluessel-ksk-2024/"
  fr: "https://tldlog.com/fr/l/iana-remplace-cle-signature-zone-racine-dns-ksk-2024/"
  it: "https://tldlog.com/it/l/iana-sostituisce-chiave-firma-ksk-2024-zona-radice-dns/"
  pt-BR: "https://tldlog.com/pt/l/iana-troca-zona-raiz-dns-nova-chave-assinatura-ksk-2024/"
  ru: "https://tldlog.com/ru/l/iana-perevodit-kornevuyu-zonu-dns-novyy-klyuch-podpisi-ksk/"
  zh-Hans: "https://tldlog.com/zh/l/iana-genqu-qiehuan-ksk-2024/"
source:
  name: "Domain Brief"
  url: "https://domainbrief.de/artikel/der-schluesselwechsel-der-root-zone-ist-ohne-groessere-bekannte-stoerungen-angel"
  language: "de-DE"
  date: "2026-10-14T06:00:00Z"
---

# IANA switches the DNS root zone to new signing key KSK-2024

## in plain words

The internet's address book for domain names uses a special key to prove its answers are genuine. On 11 October 2026, that key was replaced with a new one. Most people should not notice, but some older computers and routers may fail to load websites or email.

The DNS root zone began signing with a new key signing key, KSK-2024, on 11 October 2026, and IANA confirmed the changeover the same day. No major disruptions had been publicly reported. Resolvers may keep the old key list in their cache for up to two days, so problems in systems that have not updated could appear later.

The new key carries key tag 38696 and replaces the previous key. IANA says most users should notice nothing. Resolvers that do not recognize the new key could fail DNSSEC validation. The root key list is now signed by KSK-2024 and is valid from 00:00 UTC on 11 October, while the older KSK-2017, key tag 20326, remains listed without signing it. Google and Cloudflare public resolvers validated answers successfully, although Google still served a cached version signed by KSK-2017.

Operators on the DNS-OARC dns-operations mailing list had posted no reports about the changeover by Tuesday morning. Some individual failures appeared elsewhere. On 12 October, an administrator in the Zimbra forum reported outages on servers running Ubuntu 22.04 or older that validate DNSSEC, saying signed domains had not resolved since Sunday and email was stuck. A user in the ASUS forum said the router firmware knew only the old key, so name resolution failed when validation was enabled.

The previous root key change took place on 11 October 2018. ICANN reported minor disruptions four days later and said quick fixes resolved them. The old KSK-2010 was revoked in 2019. A further rollover is planned and will also change the signing algorithm. ICANN proposed this in February and intends to implement it unchanged, generating a new ECDSA key in 2027, with the current RSA key expiring in 2029.

Source: [Domain Brief](https://domainbrief.de/artikel/der-schluesselwechsel-der-root-zone-ist-ohne-groessere-bekannte-stoerungen-angel)

## also covered by

- [webhosting.today](https://webhosting.today/2026/10/09/the-dns-root-changes-its-key-on-sunday-a-resolver-that-still-trusts-only-the-old-one-stops-resolving-everything/) (in English)
- [icann.org](https://www.icann.org/resources/pages/ksk-rollover-en) (in English)