Rolling the DNS Root Key: October 11 and a List of Laggard ISPs

On 11 October 2026 the domain name system will undergo a rare event — a rollover of the DNSSEC root key. In an update to his May note, APNIC Chief Scientist Geoff Huston explains why this is tricky and lists the networks at risk of trouble.

Why the root key is special

Every other key in DNSSEC is validated by a parent key that signs over it. The root key (KSK) has no parent. The only way to authenticate a new key is to sign it with the old one: "old signs new." After that comes a mandatory wait so that validating resolvers can learn and begin trusting the new key. RFC 5011 calls for a hold-down of at least 30 days, during which the new key must be seen continuously before a resolver accepts it into its trusted set.

This is not an algorithm change, only a change of the key pair. The incoming key, dubbed KSK-2024 after its year of generation, was published on the IANA site in July 2024 and added to the root zone's DNSKEY record in January 2025. From 11 October it will be the one used to sign.

How readiness is measured

Huston describes two techniques. The first, from RFC 8145, embeds the tags of a resolver's trusted keys in queries toward the root servers, which their operators can read in logs. Verisign's July data shows about 90% of resolvers have added KSK-2024 — but that figure says nothing about how many users sit behind each resolver.

The second method is the RFC 8509 "sentinel": special query names force a resolver to report whether it trusts a given key, returning either a normal answer or SERVFAIL. Using APNIC's ad-based measurement system, this signal is gathered from roughly 16M queries a day. Of these, about 6M come from behind validating resolvers, and 1.8M give a clear sentinel signal. Among those, KSK-2024 adoption runs at around 70%.

A small run on RIPE Atlas probes on 5 October painted a rosier picture: across networks in 2,900 autonomous systems, only 47 probes had failed to load the new key — a 3.7% failure rate.

Who is at risk

Averages hide a wide spread, so Huston publishes a list of the fifty networks with the poorest trust in the new key (among those with at least 1,000 sentinel-capable tests). The list spans the globe: Reliance Jio in India, with a vast test count yet only 2.5% acceptance; Vodafone in Czechia, Iceland and Oman; the Philippine carriers Globe Telecom and Converge; several Iraqi providers; Azerbaijan's Telekom and dozens more.

If your ISP appears there, Huston advises checking via Cloudflare's test page and asking the operator to fix its DNS resolver — otherwise users may face failures once the key is rolled.

Source: Lobsters