The October 2026 Root KSK Rollover: Is Your DNS Really Ready?
Akamai Technologies, Thursday, October 8th, 2026
Akamai explains how to verify DNS resolvers trust the new root key KSK-2024 before the October 11, 2026 rollover to avoid SERVFAIL outages.
On October 11, 2026, the DNS root zone begins signing with a new key-signing key, KSK-2024 (key tag 38696), and validating resolvers lacking this trust anchor will fail to resolve both signed and unsigned domains.
Akamai warns that RFC 5011 automatic updates often fail because of offline or restored systems, read-only key stores, uninventoried appliances and stale golden images.
It advises confirming the key is in resolver configs, verifying the running daemon has loaded it, running RFC 8509 sentinel tests and baselining DNSSEC health to separate rollover failures from zone-specific problems such as expired signatures.