Rolling the root key
Summary
Geoff Huston's APNIC blog post covers the 2026 DNS root KSK rollover (KSK-2024) and how trust anchors are updated in DNSSEC. It explains the RFC-guided hold-down period, the process for adding the new root key to trusted anchors, and how measurements (RFC 8145 and RFC 8509) are used to assess adoption across resolvers. The article also presents real-world results and networks with slow adoption, highlighting ongoing visibility and testing needs for secure DNS resolution.