[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-dns-roots-master-key-rotates-october-11-mostly-behind-the-scenes":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},10399,"dns-roots-master-key-rotates-october-11-mostly-behind-the-scenes","DNS Root's Master Key Rotates October 11, Mostly Behind the Scenes","Cloudflare says its own 1.1.1.1 and Gateway resolvers already trust the new root key, but the global rollover deadline is October 11.","The internet's master trust key is about to change for only the second time ever.\n\nOn October 11, 2026, the DNS root will swap its key-signing key, the cryptographic anchor of DNSSEC's chain of trust, replacing KSK-2017 with a new key called KSK-2024. Resolvers that validate DNSSEC need to already trust the new key, identified by key tag 38696, or some websites could become unreachable even though they are working fine. The replacement key has been published alongside the old one since January 2025, giving resolvers time to pick it up automatically under the internet standard that governs trust-anchor updates. Cloudflare says its own 1.1.1.1 and Gateway DNS resolvers already trust KSK-2024, because the company built the new key into its software back in July 2024 instead of waiting for resolvers to learn it on their own.\n\nThis is not a routine update. The last rollover, in 2018, ran into trouble when Cloudflare found resolvers losing their learned trust anchors during software upgrades or server moves. A botched rollover does not break the cryptography, it just makes parts of the internet quietly vanish for anyone whose resolver missed the update, which is why Cloudflare is also offering a public test, built on a standard called RFC 8509, so operators can check their resolver's trust before the switch instead of after.\n\nEight years after the first rollover, the root is still signing with the same RSA method it started with, so the hard part here is logistics, not cryptography.","[\"dns\",\"dnssec\",\"cloudflare\",\"internet-infrastructure\"]","2026-10-06T17:50:11.000Z","2026-10-07T04:42:05.643Z","2026-10-07T04:42:09.613Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The dek claims 'most resolvers already trust the replacement,' but the body only supports that Cloudflare's own 1.1.1.1\u002FGateway resolvers trust KSK-2024 via a built-in anchor — rewrite the dek so it doesn't assert a broader resolver-adoption claim the body never substantiates.","resolved","security",[32,33,34,35],"dns","dnssec","cloudflare","internet-infrastructure",[37],{"name":38,"url":39},"Cloudflare Blog","https:\u002F\u002Fblog.cloudflare.com\u002Froot-ksk-2024-rollover\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",6369,"2026-10-07T14:12:37.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",897,"2026-10-07T19:53:42.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",470,"2026-10-06T19:55:11.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",437,"2026-10-07T23:01:39.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",220,"2026-10-07T19:59:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Science","science",186,"2026-10-06T21:20:39.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Consumer Tech","consumer-tech",172,"2026-10-07T17:41:41.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",111,"2026-10-07T17:47:14.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",106,"2026-10-06T20:00:30.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",105,"2026-10-07T16:59:11.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",59,"2026-10-07T21:16:18.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",56,"2026-10-07T12:00:00.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",33,"2026-10-05T11:57:17.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]