Reminder DNSSEC Root KSK roll today

Viktor Dukhovni ietf-dane at
Thu Oct 11 18:41:52 CEST 2018

On Thu, Oct 11, 2018 at 11:25:15AM -0400, Viktor Dukhovni wrote:

> In case you've not seen this many other places, just a friendly
> reminder that ICANN is rolling the DNSSEC root KSK today.  Make
> sure your resolver (if it is validating) is ready.  If you're
> forwarding queries to an upstream resolver, you might also check
> that the upstream is ready.

The new root zone is now live, with the DNSKEY RRset signed with
KSK2017 (id 20326), rather than KSK2010 (id 19036):


As cached data expires, this should make its way into all working
caches over the next day or two.


More information about the dane-users mailing list