Answer in brief
The DNS root signing key is scheduled to change on 11 October. Most users should not notice, but operators of validating resolvers need to verify their trust anchors now.
The scheduled change at the root
ICANN says the new root-zone Key Signing Key, KSK-2024, is scheduled to take over on 11 October 2026. IANA’s trust-anchor page gives the same date and says the successor will sign while the current key will no longer sign the zone. This is a plan before the cutover, not a report that it has occurred. DNSSEC uses the root trust anchor to let validating resolvers check a chain of signatures; the change therefore concerns the systems that perform that validation.
Why most people should see nothing
The successor key has been present in the root zone since January 2025, giving resolvers that follow automatic trust-anchor update rules time to learn it. ICANN says correctly configured systems should continue normally. A resolver stuck with only the old key, however, may reject signed responses after the change and make domains appear unreachable to its users. That failure would be local to affected validation paths, not proof that the entire internet has failed.
A practical pre-cutover check
Operators should inventory recursive resolvers that validate DNSSEC, confirm that KSK-2024 is trusted, and identify any manually pinned anchors or blocked automatic updates. ICANN identifies key tag 38696 for the successor; IANA publishes the anchor data. ISC’s BIND guidance explains why automatic and manual validation configurations behave differently. Changes to production DNS need the normal change window, monitoring and a recovery plan; simply disabling validation would conceal the symptom while removing a security control.
What October evidence can show
Before 11 October, teams can establish a baseline of validation errors and test representative resolver paths. During and after the scheduled switch, they can compare error rates and user reports with that baseline. The published schedule does not predict the number of affected networks, nor does it mean every DNS operator must replace hardware. At the 1 October cutoff, the date, keys and preparation guidance are documented; the outcome of the rollover remains future evidence.
Questions and answers
Will every internet user need to change a setting?
No. ICANN expects the transition to be invisible for properly configured validating resolvers; the preparation is mainly for DNS operators.
Is this a new DNSSEC algorithm?
No. This is a rollover of the root key, not the separate proposal for a future algorithm change.