ICANN/IANA Update#
ARIN 56 Public Policy and Members Meeting digest Program Core pick 30–31 October 2025
- Why: Two operationally significant DNSSEC events are on the calendar, and every operator running a validating resolver needs them on a roadmap, not a surprise.
- What: The second-ever Root Zone KSK rollover is scheduled for 11 October 2026, establishing a recurring 3-year rollover cycle (delayed by COVID and a key-hardware vendor change). Separately, a proposal to change the KSK algorithm from RSA/SHA-256 to ECDSA P-256 with SHA-256 goes to public comment in February 2026. The trust anchor has been published in the DNS itself since 11 January 2025; operators should verify their systems have adopted it via software updates.
- How: Rollover propagates through vendor updates and the XML trust-anchor file rather than manual operator action for most deployments; the algorithm change is a slower, more disruptive migration being run through open IETF/community process. Also noted:
.arpadomains are being published in the RDAP bootstrap (reverse-DNS queries will redirect to the relevant RIR) as ICANN sunsets WHOIS, and IANA is investigating participating in RPKI for reserved or special-use space — an early watch item. - Where applicable: General — anyone operating validating resolvers or DNSSEC-signing infrastructure. The RPKI-for-special-use-space item is exploratory but relevant to routing-security watchers.