The DNS Root Key Is About to Change, and 50 ISPs Are Not Ready
Rolling the Root Key
On October 11, 2026, the DNS root key will roll for the first time since 2017. Unlike other DNSSEC keys, the root key has no parent, so the old key must sign the new one, and resolvers need time to trust it. Measurements show about 70% of validating resolvers have loaded the new key, but a list of 50 ISPs—including Globe Telecom, Reliance Jio, and Vodafone-CZ—have low adoption rates, risking validation failures for their users.
The KSK roll may present the listed ISP resolvers with some problems. If your ISP is listed in Table 3, then you may want to follow up using Cloudflare's test script and ask your ISP to review their DNS settings.