Infrastructure, domains & the recurring invoice of civilisation

The Hosting Times

Independent reporting on web hosting, domains and the infrastructure behind the internet.

Domains

DNS Root Key Rollover Puts Resolver Readiness on Hosting Checklist

October 7, 2026 ·
DNS Root Key Rollover Puts Resolver Readiness on Hosting Checklist

AI-generated illustrative image.

DNS resolver operators have only days left to confirm they trust the next DNS root key before the scheduled root KSK rollover on October 11, 2026. Cloudflare warned this week that the DNS root is set to switch to KSK-2024, only the second root key-signing-key rollover in DNSSEC history.

The issue matters for hosting providers, managed DNS teams, enterprises, ISPs, and anyone operating DNSSEC-validating resolvers. DNSSEC validation depends on a chain of trust that starts at the DNS root. If a validating resolver has not learned or installed the new root trust anchor, otherwise healthy domains can fail validation and appear unreachable after the rollover.

Cloudflare said most website owners do not need to make changes. Customers using Cloudflare authoritative DNS, 1.1.1.1, or Gateway DNS are already covered, according to the company. The action item is for resolver operators: verify that KSK-2024, key tag 38696, is present in trust-anchor configuration and follow resolver-vendor guidance if it is missing.

ICANN’s own rollover guidance gives the same reminder: operators of DNSSEC-validating resolvers should not assume automatic trust-anchor updates succeeded. That is especially relevant for hosting networks that maintain recursive resolvers for customers, data-center operations, or control-plane services.

Why hosting operators should care

DNS failures often look like application outages. A stale DNSSEC trust anchor can break name resolution before web servers, CDNs, mail platforms, or customer dashboards ever receive traffic. Providers running validating resolvers should check production, staging, and disaster-recovery resolver fleets, including older appliances and images that may not have updated automatically.

Cloudflare also published a readiness test using RFC 8509 trust-anchor sentinel queries, allowing operators to test whether a resolver indicates trust in KSK-2024. The practical message is simple: validate resolver readiness before the cutover window, not after customer domains start returning SERVFAIL.

Sources: Cloudflare Blog; ICANN root KSK rollover guidance.