DNS resolvers need to trust the new root key before October 11

The DNS root is scheduled to change its key-signing key on October 11. DNSSEC-validating resolvers must already trust the replacement, or they can reject legitimate DNS answers and make working websites unreachable. Cloudflare explains the trust chain and provides a browser test that checks whether a supporting resolver recognizes the new key.

Cloudflare · Oct 6, 2026

Why it matters

Resolver operators have a concrete readiness check before a change that can affect many otherwise healthy services.

More context

Check for KSK-2024, key tag 38696, and follow the resolver vendor’s update guidance if it is missing. Most website owners need no changes; Cloudflare says its DNS resolvers already trust the key. Try the linked readiness test on the network path you actually use.

Keep in mind

The browser test can use a VPN or Secure DNS resolver rather than your operating system’s resolver. Missing sentinel-protocol support makes its result inconclusive, not proof that the key is absent.

Original read