DNSSEC Project Archive

These are archived documents from specific community projects relating to the development and evolution of DNSSEC in the Root Zone. These documents should not be relied upon for up-to-date information on operations and are provided for historical purposes only.

Initial Design and Launch (2008-2010)

The DNS root zone began being signed in July 2010, following an extended process of consultation and design work. These documents are the historical archive of working documents from this process. These were originally published in a dedicated microsite at root-dnssec.org.



First KSK Rollover Project (2015-2018)

Commencing in 2015, a community design team was formed to develop recommendations on how to perform the first "KSK rollover", replacing the Root Zone Key Signing Key as required by our DNSSEC Practice Statement. These recommendations were operationalized, and the first KSK rollover resulted in the generation of a new KSK in October 2016, and replacing the KSK in the root zone in October 2018.