Signal / 020 — The DNS root changes keys today; validating resolvers need KSK-2024

The DNS root is scheduled to switch its key-signing key today, October 11, for only the second time. The replacement, KSK-2024, becomes the trust anchor validating resolvers use to authenticate the root’s DNSKEY set. Most people and website operators do not need to change anything. Home-lab operators running their own DNSSEC-validating resolver should pay attention.

What can break

DNSSEC builds a chain of cryptographic trust from the root through a top-level domain and down to a signed domain. A validating resolver that does not trust the new root key can reject otherwise healthy DNS answers. The practical symptom is ugly and misleading: websites and services appear unreachable even though their servers and authoritative DNS are working.

Cloudflare’s rollover guide says KSK-2024 has key tag 38696 and has been published in the root DNSKEY set since January 11, 2025. Resolvers using RFC 5011 can learn new trust anchors automatically, but upgrades, migrations, snapshots, and stale persistent state can disrupt that process. Cloudflare provides a browser-based readiness test using RFC 8509 trust-anchor sentinels. An inconclusive result may mean the resolver lacks sentinel support; it does not automatically prove the key is missing.

Home-lab checklist

If you operate Unbound, BIND, or another validating resolver, confirm that its trust-anchor data includes KSK-2024 and follow that software vendor’s update instructions if it does not. Check logs for validation failures and test through the same resolver path your clients actually use; browser Secure DNS and VPNs can silently send the test somewhere else. Users of Cloudflare 1.1.1.1 and Gateway DNS need no action, according to Cloudflare.

Opinion: this is quiet infrastructure doing exactly what it should: rotate the root of trust before it becomes permanent furniture. Built for the edge cases means testing the resolver nobody remembers until DNS disappears.

AI-assisted summary; sources were reviewed and the article was edited for accuracy and clarity.