← Wednesday, October 7, 2026Cloud & infraGuide

DNSSEC resolvers must trust KSK-2024 before the 2026 root key rollover

blog.cloudflare.com by Sebastiaan Neuteboom, James Godlewski 9 min read Editor score 7/10

Cloudflare says validating resolvers need to trust KSK-2024 ahead of the October 11, 2026 rollover, and notes that upgrades or machine moves previously caused resolvers to lose learned trust. Resolver operators should verify trust anchors before the switch.

What: The DNS root is scheduled to replace its key-signing key on October 11, 2026; validating resolvers must trust KSK-2024 beforehand.
How: Resolvers use a trusted root KSK to verify the root DNSKEY set, then use the ZSK to verify other root records.
Why it matters: If a resolver lacks the new trust anchor, DNSSEC checks may fail and users may be unable to reach websites.

The resolver follows DNS queries through the hierarchy while DNSSEC trust extends from the root to child zones. Sketched from the article's own text.

Read on blog.cloudflare.com →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.