The keys to the Internet change on October 11, 2026. Are you ready?

This post details the upcoming DNS root KSK rollover on October 11, 2026. It explains the importance of DNSSEC, the role of the Key-Signing Key (KSK), and the process of trust anchor updates for resolvers. Cloudflare has proactively updated its resolvers (1.1.1.1 and Gateway DNS) to trust the new KSK-2024 by embedding it directly into software trust anchors. The post introduces RFC 8509, the root key trust anchor sentinel, and provides a readiness test website and dig commands to verify resolver trust in KSK-2024. It also discusses the continued use of RSA/SHA-256 for the KSK and the reasons for the delay in algorithm changes.