Prepare Your Systems for the Root KSK Rollover
If your software does not support automated updates of DNSSEC trust anchors (RFC 5011) or is not configured to use it, you must manually update the software’s trust anchor. The new root zone KSK is available here: http://data.iana.org/root-anchors/.
ICANN offers a test bed that you can use to verify if your systems can successfully update a trust anchor using the automated update protocol. If you want to learn about using ICANN’s test bed, visit