When an Internet user types a domain name into a search engine, how can we ensure that where they land is truly the desired destination? Typosquatting and other types of cyberfraud make it increasingly challenging and unclear to the user.
Domain Name System Security Extensions (DNSSEC) are vital to Internet security, helping to authenticate destination addresses and secure online transactions. At the heart of this system is the root zone Key Signing Key (KSK) – the ultimate cryptographic anchor that secures the Internet's addressing system.
As we approach late 2026, ICANN and Verisign are preparing to update this key for only the second time in history. In the meantime, here is a summary of how we got here, what the data shows, and the critical steps network administrators must take today.
Lessons from the First Rollover
The first ever KSK rollover took place in October 2018. Originally scheduled for 2017, it was postponed for one year to allow more time for outreach after data showed that many operators had not yet updated their systems to support the new key.
While the original plan called for a rollover every three years, several real-world factors changed the timeline. The COVID-19 pandemic temporarily forced remote-only attendance at key-signing ceremonies. Later, an upgrade to new Hardware Security Modules (HSMs) necessitated generating a brand new cryptographic key – the current KSK-2024.
Strong Adoption Rates
The current rollover actually started in 2024 and the new key was first published in the root zone on 11 January 2025. Under the automated trust update process (RFC 5011), Domain Name System (DNS) resolvers must observe a new key for 30 days before automatically trusting it. Data shows that the current adoption curve nearly mirrors the successful 2018 rollover, with more than 95 percent of reporting resolvers successfully recognizing and adopting KSK-2024.
The Critical Deadline: 11 October 2026
On 11 October 2026, the root zone will begin using only KSK-2024. What this means for you is that if your DNSSEC-validating resolver does not have KSK-2024 configured by this date, your network will experience total DNS resolution failures, cutting off Internet access for your users.
System administrators must manually verify their configurations rather than assume automatic updates worked. The key to look for is Key Tag 38696. Check your software's trust anchor file to ensure it is present:
- ISC BIND: bind.keys
- Unbound / PowerDNS Recursor: root.key
- Knot Resolver: root.keys
If Key Tag 38696 is missing, verify that automatic trust updates are enabled and that your resolver has write permissions to its storage directory.