Newsbite analysis · Security
Cloudflare
The keys to the Internet change on October 11, 2026. Are you ready?
In a significant update, the Internet's root key-signing key (KSK) will change on October 11, 2026, marking only the second instance of such a rollover. This key is critical for DNSSEC which ensures the authenticity and integrity of web addresses. Website operators must ensure their DNS validators trust the new KSK-2024 to avoid service disruptions. Validating resolvers need to check their trust for this new key before the official switch, as a failure could result in websites being unreachable even if they are operational. Cloudflare users need not worry, as their systems are already set to trust the new key; others should verify their readiness through the provided tests.
MonitorConfidence: HighShort term horizonStory: First report
EvidenceOfficial announcementCompany only
Published 6 Oct 2026, 18:40 UTC10 min read
Lead image — Cloudflare
Brief
NewsBite reading:DNS Root Key Change Scheduled for October 2026: Prepare Your Resolvers
TL;DR
- The DNS root KSK will change to KSK-2024 on October 11, 2026.
- The change is critical for ensuring DNSSEC's chain of trust.
- Resolvers must trust the new key to maintain website accessibility.
- KSK-2024 will replace KSK-2017 as the signer of the root's DNSKEY set.
- Cloudflare has preemptively trusted the new key in its systems.
- Users can check their resolver's trust status through a readiness test.
Interesting facts
- The first change occurred in 2018, highlighting the complexities faced by resolvers.
- KSK-2024 has been published since January 2025 to aid in preparation.
- ICANN plans future rollovers to possibly incorporate post-quantum cryptography.