Rolling the Root Key (Update)
Summary
Geoff Huston updates the DNS root key rollover plan for October 2026, explaining how the old KSK signs the new one and the 30-day hold-down window per RFC 5011. It reviews DNSSEC trust anchor measurement approaches (RFC 8145 and RFC 8509) and shares early results showing around 70% adoption, with a list highlighting networks lagging in trust anchor loading. Practical guidance is provided for operators and SMBs to verify their resolvers and trust anchors using available test scripts.