The latest episode of PING features Duane Wessels, a Verisign fellow specializing in DNS research, examining the mechanics and history behind root Key Signing Key (KSK) rollovers—the process of swapping out the cryptographic key that secures the entire DNS root zone. The second such rollover reaches a major turning point on 11 October 2026, when the third KSK enters active service and assumes responsibility for signing the root zone.

The original KSK went into operation in 2011. A first rollover succeeded in 2017, but complications that emerged in 2020 and 2023 pushed back the second rollover by several years. When the transition occurs this month, the new key pair will begin signing operations while the previous pair steps back from active use, though it will remain visible in the root zone through early 2027.

Wessels has collaborated with Roy Arends of ICANN on research into how resolvers behave during a root KSK rollover. Two research articles document their findings: The 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends (March 2025) and The 2024-2026 Root Zone KSK Rollover: Updates and Observations (July 2026). Together they show how the researchers' insights deepened as the rollover unfolded and how early observations shaped later investigation.

Trust anchors and resolver visibility

The DNS root KSK serves as the foundational trust source for all DNSSEC-signed data globally. IANA manages the private keys tied to this public-private key pair, while Verisign handles generation, maintenance, distribution and operational deployment of the key material. Wessels participates directly in ICANN and IANA key ceremonies and leverages Verisign's operational vantage point through the J root server's anycast network to observe global DNS behavior.

This rollover benefits from far greater visibility into resolver behavior than the 2017 rollover allowed. Since then, an increasing share of resolvers have adopted the signalling mechanism specified in RFC 8145, which lets validators announce which Trust Anchors they have installed and are actively using. This mechanism provides clearer data on Trust Anchor adoption across the Internet, with time-series measurements tracking how the new key material spreads.

Timeline and deployment progress

Root KSK rollovers are not isolated events but rather carefully orchestrated, multi-year undertakings. The current rollover is approaching a significant milestone this month. The new KSK has been published in the root zone since January 2025 and qualified for automatic installation by validating resolvers through the RFC 5011 Trust Anchor update mechanism in February 2025. This gave operators many months to prepare their systems and adopt the new Trust Anchor before the signing transition.