The root zone KSK rollover lands on 11 October — here is what actually breaks
Published July 29, 2026 · DNS Benchmark Pro Editorial · Reading time: 3 minutes
In short — On 11 October 2026 ICANN switches the root zone to KSK-2024. Resolvers that never picked up the new trust anchor will start returning SERVFAIL for everything. Here is who is exposed and how to check.
On 11 October 2026, ICANN switches the root zone over to a new Key Signing Key, KSK-2024. Every validating DNS resolver on the planet depends on that key. If yours has not picked it up, it stops being able to validate anything, and it will tell you so with a wall of SERVFAIL.
The good news is that this has been telegraphed for a long time. KSK-2024 was pre-published in the root zone on 11 January 2025, which gave resolvers running RFC 5011 automated trust anchor management well over eighteen months to notice it, accept it, and hold it alongside the outgoing KSK-2017. October is not when the new key appears — it is when the new key starts signing. The old KSK-2017 is then revoked on 11 January 2027.
Who is actually at risk
Not you, if you use one of the large public resolvers. Cloudflare, Google, Quad9, OpenDNS and the rest have dedicated teams whose entire job is to not be the ones who get this wrong. They have been carrying KSK-2024 since early 2025.
The exposure sits with resolvers that nobody is watching:
- Self-hosted BIND, Unbound and Knot instances that were configured once, years ago, and have had their trust anchor file frozen ever since — often because RFC 5011 was disabled in favour of a hand-pinned key.
- Appliances and CPE with embedded resolvers — routers, firewalls, NAS boxes, IoT gateways — where the trust anchor ships in firmware and the firmware has not been updated in two years.
- Air-gapped or heavily filtered networks where the resolver could not reach the root servers often enough for RFC 5011's hold-down timer to complete.
- Container images and golden AMIs baked before January 2025 and never rebuilt.
The failure mode is what makes this nasty. A stale trust anchor does not degrade gracefully. Validation fails, the resolver returns SERVFAIL, and from the user's seat the entire internet simply stops. There is no partial outage to reason about and nothing in the error that points at DNSSEC. Expect a wave of tickets in mid-October that look like everything from "VPN is down" to "the printer cannot reach the cloud".
How to check, in one command
On a Unix host, ask your resolver directly whether it is willing to validate a correctly signed name and reject a deliberately broken one:
dig +dnssec dnssec-failed.org @YOUR_RESOLVERA resolver that is validating correctly returns SERVFAIL for that name — it is a test domain published with deliberately broken signatures. A resolver that returns an A record is not validating at all, which is its own problem but at least means October will pass unnoticed.
To confirm which trust anchors a resolver holds, check the managed-keys database directly. On BIND that is rndc managed-keys status; on Unbound it is the contents of root.key (look for a record with key tag 38696, which is KSK-2024). If you only see key tag 20326 — KSK-2017 — you have work to do before October.
The wider point
Trust anchor rollovers are rare enough that most operators have never lived through one. The 2018 KSK-2017 rollover was delayed by a year precisely because ICANN's telemetry suggested a meaningful number of resolvers were not ready, and even then it passed with far less damage than feared. That history cuts both ways: it is genuinely likely that October goes quietly, and it is genuinely likely that the handful of networks it does hit will spend a day and a half misdiagnosing it.
If you run your own resolver, verify the trust anchor this month. If you rely on a public resolver — and our benchmark exists to help you pick a good one — this is one more argument for using an operator that treats DNSSEC as a full-time job.
Sources: ICANN, Proposal for Root Zone KSK Algorithm Rollover; CIO, "CIOs beware: DNS KSK rollover could kick off wave of mysterious outages"; Verisign Blog, "The 2024-2026 Root Zone KSK Rollover".
Published by Genext Information Systems · July 29, 2026. DNS Benchmark Pro is an independent tool and is not affiliated with any vendor or organisation named in this article. This report summarises publicly available disclosures and is provided for informational purposes.