DNS root rotated its master key to KSK-2024 on October 11 without outages

On October 11, 2026, the DNS root zone switched signing from KSK-2017 to KSK-2024 — only the second root key rollover ever, after 2018. The change caused no broad outage, but resolvers that failed to adopt the new trust anchor may return SERVFAIL for every lookup. KSK-2017 will be revoked on January 11, 2027, and removed from the zone on March 22, 2027.

• On October 11, 2026, KSK-2024 began signing the root DNSKEY set, replacing KSK-2017
• It is only the second root key rollover in history; the first was in 2018
• KSK-2024 was published in the root on January 11, 2025 for RFC 5011 auto-adoption
• KSK-2017 gets the REVOKE bit on January 11, 2027 and is removed on March 22, 2027