The Internet's root key changes on October 11: the DNSSEC KSK rollover
The DNS root zone is set to change its key-signing key (KSK) on October 11, 2026, only the second time ever. Validating resolvers must trust the new KSK-2024 (key tag 38696) beforehand, or otherwise healthy websites could become unreachable. Cloudflare says users of its DNS, 1.1.1.1 and Gateway DNS need to take no action, and has opened a readiness test.
