IANA switches the DNS root to its new KSK-2024 signing key

On October 11, 2026, the DNS root zone switched to a new key-signing key. IANA’s trust anchor page lists KSK-2024, key tag 38696, as the active key signing the root from that date. The previous key, KSK-2017 (tag 20326), had signed the root since October 11, 2018 and is now in post-publication.

The rollover timeline

Step	Date
KSK-2024 published in the root zone	January 11, 2025
Automatically updating resolvers can trust KSK-2024	February 10, 2025
KSK-2024 starts signing; KSK-2017 stops	October 11, 2026
KSK-2017 revoked	January 11, 2027
KSK-2017 removed	March 22, 2027

IANA’s page says validating resolvers must have updated trust anchors to keep validating the root zone.

Who needs to do something

Domain owners: nothing. Namecheap’s guide says owning domains, or turning on DNSSEC for them at your registrar, does not put you on the hook. That is the publishing side of DNSSEC, and it keeps working as before.

Resolver operators: check the trust anchor. The work falls on whoever runs a recursive resolver that validates DNSSEC, such as an office appliance, a campus resolver, or Unbound or BIND on a server. A resolver that never picked up key tag 38696 fails validation for signed domains, so many sites look unreachable even though nothing is wrong with them. Namecheap’s checklist: confirm 38696 is in the trust anchor file, confirm automatic updates are on, and make sure the resolver can write to that file. Resolvers restored from old snapshots or images are the most likely to be missing it.

If you use your internet provider’s resolver or a public resolver, keeping the key current is that provider’s job.

What to do

If people on your network report that many unrelated sites stopped loading since October 11 while those sites work elsewhere, check your own resolver’s trust anchor first. Turning off DNSSEC validation hides the symptom but drops the protection, so fix the anchor instead.