Root KSK Rollover Complete: KSK-2024 Signs the Root Zone Since October 11

IANA switched the DNSSEC root zone to the new KSK-2024 key (key tag 38696), which has been signing the root since October 11, 2026, replacing KSK-2017. Resolvers whose trust anchors lack the new key will return SERVFAIL; Verisign data shows about 90% of reporting resolvers already trust KSK-2024, though some ISPs are below 10%.

• KSK-2024 (key tag 38696) signs the root zone since October 11, 2026
• KSK-2017 (key tag 20326) no longer signs the root zone
• About 90% of resolvers trust KSK-2024, some ISPs below 10%
• KSK-2017 revocation is scheduled for January 11, 2027, removal for March 22, 2027