Updated October 12, 2026: The DNS root zone began using a new DNSSEC key-signing key on October 11. Most website owners and hosting customers do not need to change anything, but operators of DNSSEC-validating recursive resolvers should confirm that their systems trust KSK-2024, identified by key tag 38696.
Event date: October 11, 2026
Source checked: October 12, 2026
Verification status: Corroborated
What Happened
IANA confirmed that the DNS root zone began using KSK-2024 on October 11, replacing KSK-2017 as the key used to sign the root DNSKEY record set. The new key has key tag 38696; the previous signing key has tag 20326.
The change is part of a planned DNSSEC trust-anchor rollover. KSK-2024 had been present in the root zone since January 11, 2025, giving resolvers that follow the RFC 5011 update process time to learn and trust it before it became the active signing key.
Why It Matters
DNSSEC-validating recursive resolvers use the root trust anchor to verify the chain of signatures behind signed DNS answers. A resolver that still trusts only the old key can reject otherwise valid answers after the rollover. To users behind that resolver, websites and other services using signed domains may appear unreachable even though the domains, authoritative DNS and hosting platforms are operating normally.
This is principally an infrastructure-operator issue, not a registrar setting that ordinary domain owners must change. If a business uses an ISP, public resolver or managed DNS service for recursive resolution, the resolver operator is responsible for its trust anchor. Organizations running BIND, Unbound, PowerDNS Recursor, Knot Resolver or appliances that validate DNSSEC should check their own systems.
What the Organizations Say
IANA says KSK-2024 is now signing the root zone and that validating resolvers must have updated trust anchors to continue validating it. ICANN's operator guidance says administrators should verify that key tag 38696 is present and should not assume automatic trust-anchor updates succeeded.
Namecheap's October 9 explainer makes the same customer-impact distinction: owning a domain or enabling DNSSEC at a registrar does not by itself make the customer responsible for a recursive resolver's trust anchor.
HostingReviewLab Context
For hosting customers, a stale resolver can look like a hosting outage because multiple unrelated signed domains can fail at once. A useful diagnostic is to test the same name through a known-good public resolver. If it resolves there but fails through the organization's resolver, the problem points toward local DNSSEC validation rather than the website's server.
This rollover does not change a domain's nameservers, hosting account, DNS records or registrar. It also does not mean that a provider-wide outage occurred on October 11.
What We Haven't Independently Verified
HostingReviewLab verified the official rollover status and guidance, but did not operate or test a representative sample of validating resolvers during the transition. We also have not identified authoritative evidence of a widespread customer-impact incident. Individual failures may still occur on old appliances, systems restored from stale snapshots or resolvers with manually maintained trust anchors.
What Customers Should Know
- Most domain and hosting customers: no action is expected.
- Resolver operators: confirm that KSK-2024, key tag 38696, is in the active trust-anchor configuration.
- If many signed domains suddenly fail: compare resolution through another trusted resolver before treating the problem as a hosting outage.
- If the new key is missing: follow the resolver vendor's documented trust-anchor recovery process. Disabling DNSSEC validation removes protection and should not be treated as the permanent fix.
For a broader incident checklist, see HostingReviewLab's guide to separating hosting, DNS and application failures.
Sources
- IANA: DNS Root Zone Begins Using New Key Signing Key — published October 11, 2026.
- IANA: DNSSEC Trust Anchors and Rollovers — checked October 12, 2026.
- ICANN: Root Zone KSK Rollover — checked October 12, 2026.
- Namecheap: A practical guide to the October DNSSEC rollover — published October 9, 2026.