ICANN completes DNS root key rollover
ICANN completed the scheduled rollover of the DNS root zone key signing key on 11 October 2026. The organisation is investigating reports of issues affecting a limited number of systems and will continue monitoring the network as the process moves towards the planned revocation of the previous key in January 2027.
The cryptographic key used to secure the Domain Name System (DNS) has been replaced as scheduled, marking a key step in the ongoing maintenance of DNS Security Extensions (DNSSEC). The Internet Corporation for Assigned Names and Numbers (ICANN) confirmed on 15 October that the root zone key signing key (KSK) rollover was completed on 11 October.
ICANN has received reports of problems affecting a limited number of systems following the transition. It is assessing whether the issues are connected to the rollover and says monitoring will continue throughout the remaining stages.
The root zone KSK acts as a trust anchor for DNSSEC, allowing resolvers to check whether DNS information is authentic and has remained unaltered in transit. Replacing the key periodically helps maintain the security of the DNS and tests whether the software and operational procedures supporting this system remain ready for future transitions.
The rollover was conducted under established procedures, with coordination across the global technical community. Internet service providers, network operators, resolver software developers and equipment vendors all have a role in ensuring that their systems support DNSSEC key changes.
The process is not yet fully complete. The previous KSK is scheduled for revocation in January 2027, and ICANN will continue working with DNS operators to identify and address any unexpected issues. Operators are advised to follow existing guidance and prepare for the remaining milestones.
The first root zone KSK rollover took place in 2018. Since then, periodic key replacement has become part of routine DNSSEC operations, helping maintain the reliability of the cryptographic trust chain that supports the DNS.
Further technical information and the rollover schedule are available through IANA’s DNSSEC resources.
