DNS root KSK rollover · 2026-10-11
Will your resolver survive the root key rollover?
On 11 October 2026 the DNS root is signed only by KSK-2024 (key tag 38696). Any validating resolver that does not trust it fails every lookup. Paste your trust-anchor listing — Rootroll does the crypto itself and tells you the verdict.
…until 11 Oct 2026 00:00 UTC. Failures can begin any time from the roll until cached root keys expire (up to 48 h later).
Live root panel
Fetching the live root DNSKEY set…