DNS Root Zone Begins Using New Key Signing Key

The DNS root zone began using a new Key Signing Key (KSK) on 11 October 2026.

The new KSK, identified by key tag 38696, replaces the previous key for the DNS root zone. This change is part of the planned KSK rollover and ongoing maintenance of the DNSSEC trust anchor. The KSK is used as the trust anchor for DNSSEC validation.

Most users are not expected to experience any disruption. However, DNSSEC-validating resolvers that have not been updated to trust the new KSK may experience DNSSEC validation failures. There is a KSK rollover resource center available on ICANN’s website with more information.