Agentic data science with the Data Agent Kit
cloud.google.com·7h ago
Security
Cloudflare Blog·6d ago·5 min read
The keys to the Internet change on October 11. Are you ready?
TL;DR
On October 11, 2026, the DNS root will undergo its second key-signing key (KSK) rollover, transitioning from KSK-2017 to KSK-2024. This change is crucial for maintaining the integrity of DNSSEC, and resolvers must trust the new key to avoid website accessibility issues.
✦ Why It Matters
Check your DNS resolver's trust in KSK-2024 to ensure uninterrupted website access after October 11, 2026.
Key Takeaways
- Verify your DNS resolver trusts KSK-2024 before October 11, 2026.
- Use Cloudflare's readiness test to check key trust status.
- Update your DNSSEC-validating resolver according to vendor instructions.
- Understand the implications of DNSSEC for website accessibility.
How It Works
DNS resolvers authenticate website addresses using a chain of trust established by DNSSEC. The root key, which has no parent to verify its authenticity, serves as a trust anchor.
The KSK signs the DNSKEY record set, which includes public keys for top-level domains. When a new KSK is introduced, resolvers must verify it over a 30-day period before accepting it as a trust anchor.