DNS Root Switches to KSK-2024; Stale Trust Anchors Can Break Resolution

The DNS root zone began using KSK-2024, key tag 38696, to sign the root on October 11, 2026. ICANN says operators of DNSSEC-validating resolvers should verify that the new key is present and should not assume automatic trust-anchor updates succeeded. IANA's trust-anchor record now lists KSK-2024 as active and KSK-2017 as no longer signing the zone. ## Affected systems The exposure is limited to DNSSEC-validating recursive resolvers whose trust-anchor state did not learn KSK-2024. That can include manually pinned configurations, appliances with stale trust stores, or resolvers where automatic RFC 5011-style updating was disabled or failed. Ordinary clients inherit the condition of the resolver they use. ## Access path This is an operational trust failure, not a newly disclosed attacker access path. A validating resolver that still trusts only the retired signing key cannot complete the cryptographic chain from the root after the signing change. ## Impact For users behind an affected resolver, correctly signed DNS answers can be rejected as bogus. The practical symptom is broad DNS resolution failure, which can make websites, mail, APIs, and other name-dependent services appear offline even while their servers remain healthy. ## Mitigations Resolver operators should confirm that trust anchor key tag 38696 is installed, verify that automatic trust-anchor maintenance is enabled and functioning, and follow their resolver vendor's recovery guidance if it is absent. ICANN specifically warns operators not to infer success merely because automatic updating was configured. ## Uncertainty The rollover itself is confirmed by ICANN and IANA. At publication time, these primary sources do not report a measured global outage or quantify how many resolvers failed to update. This report therefore describes the confirmed protocol-state change and its bounded failure mode, not evidence of a widespread disruption.