The Root KSK Rollover Is Done. Did Your Resolver's Trust Anchor Change?
The root KSK rollover swapped the key at the top of the DNSSEC chain, and what matters now is whether each of your validating resolvers swapped with it. IANA's Trust Anchors and Rollovers page lists KSK-2024 (key tag 38696) as signing since 2026-10-11, with KSK-2017 (key tag 20326) no longer signing the root zone. IANA's announcement of 11 October states that the root zone began using a new KSK…
The root KSK rollover completed the transition to a new key signing the root DNS zone on October 11, 2024. Resolvers must update their trust anchors to recognize the new KSK or they will not be able to validate DNSSEC-signed data. Not all resolvers automatically update their trust anchors; some maintain static anchors or rely on external images for configuration.
Operators must verify each resolver's trust anchor configuration to ensure they have updated to KSK-2024. Failure to update trust anchors can cause resolvers to return SERVFAIL errors for both signed and unsigned domains, as the validating process cannot complete the chain of trust. This issue is not limited to specific domains or types of resolvers; it affects all resolvers that do not have KSK-2024 in their trust anchors.
Operators should check their resolver configurations, update pinned anchors if necessary, and ensure resolvers are watching for revocation announcements from the root zone to properly handle the transition.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
