The DNS Root Changes Its Key on Sunday. A Resolver That Still Trusts Only the Old One Stops Resolving Everything.

On Sunday, October 11, the DNS root zone’s DNSKEY set will be signed only by KSK-2024, key tag 38696, and KSK-2017, key tag 20326, stops signing after eight years. For nearly everyone this is invisible: the new key has been published in the root since January 2025, current resolver software ships with it, and ICANN’s July figure was that “more than 95 percent of reporting resolvers” already trust…