Skip to content

Root KSK Rollover 2026: An Operator's Readiness Checklist#

nog.fi meeting 2026.06 digest Program Adjacent pick 16–17 June 2026

Abstract Recording

Roy Arends (ICANN)

Play the recording: Root KSK Rollover 2026: An Operator's Readiness Checklist

  • Why: October 2026 brings the first root KSK rollover since 2018; validating resolvers with badly managed trust anchors are the ones that break. This is a concrete, adoptable checklist — exactly the kind of ops content worth taking away.
  • What: A minutes-long readiness checklist for validating-resolver operators: verify resolvers use managed trust anchors, confirm the active root KSK, and inspect RFC 5011 state — with concrete commands and expected outputs for common resolver software, designed to slot into existing workflows. (from abstract only)
  • How: Relies on RFC 5011 automated trust-anchor updates (or RFC 9718 operation); the checklist catches hardcoded/static trust-anchor configurations before they break.
  • Where applicable: Any operator of validating recursive resolvers, regardless of scale. Should be routine if trust anchors are already managed correctly.