In case you've not seen this many other places, just a friendly reminder that ICANN is rolling the DNSSEC root KSK today. Make sure your resolver (if it is validating) is ready. If you're forwarding queries to an upstream resolver, you might also check that the upstream is ready. -- Viktor.