Mission Accomplished? The 2026 KSK Rollover Story#

Carlos Martínez (LACNIC), Nicolás Antoniello (ICANN)

• Why: The Internet's largest trust-anchor key rotation executed 11 October 2026 — and the talk's core message is a per-instance verification checklist, not a victory lap. A good template for any large-scale key-rollover program, including workload-identity trust roots.
• What: KSK-2024 (key tag 38696 / 0x9728) has signed the root DNSKEY set since 11 Oct 2026 14:00 UTC, after 21 months of prepublication (published Jan 2025, RFC 5011 acceptance Feb 2025). KSK-2017 stays published but non-signing until revocation (11 Jan 2027) and retirement (22 Mar 2027). Telemetry reading: RFC 8145 _ta- anchor-tagging queries (one capture showed ~38,989 unique source IPs still announcing only the old anchor) are a risk signal, not a census of failures — the 2018 lessons hold: forwarders mask the origin, signaling does not prove validating, and few reports do not prove absence of failures. "Completed" does not mean "all systems verified."
• How: Per-instance verification: 38696 present as accepted (not pending) in the effective trust-anchor state (rndc managed-keys status, rndc secroots), state persistence across restarts/replicas/containers/standbys and forwarding paths, and functional tests (valid root SOA with the AD bit; SERVFAIL on a known-broken domain; +cdflag as diagnostic only).
• Where applicable: Anyone operating DNSSEC-validating resolvers — especially forwarders and replicated/containerized deployments where RFC 5011 state can be lost on restart. Fully general.