Hi everyone,
Just a reminder that the next DNSSEC root Key Signing Key (KSK) rollover is coming up on 11 October 2026.
For those operating DNSSEC-validating resolvers, it might be worth double-checking that your resolvers have picked up the new KSK-2024 trust anchor (key tag 38696) through standard software updates or RFC5011.
There's a handy test provided by Cloudflare to check whether your resolvers are ready: https://dnstest.dev/ksk-2024/
Cheers, Oli
Did anyone have any problems? Seems like it was a big nothing (quite nice).
Eliot
On 09.10.2026 09:29, Oli Schacher via swinog wrote:
Hi everyone,
Just a reminder that the next DNSSEC root Key Signing Key (KSK) rollover is coming up on 11 October 2026.
For those operating DNSSEC-validating resolvers, it might be worth double-checking that your resolvers have picked up the new KSK-2024 trust anchor (key tag 38696) through standard software updates or RFC5011.
There's a handy test provided by Cloudflare to check whether your resolvers are ready: https://dnstest.dev/ksk-2024/
Cheers, Oli
swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch
Some glitches here and there, notably bundled unbound version in opendkim for example.
But the warning made lots of people react I think, so everyone updated their anchors I guess
Thanks Oli for the heads up btw
Le 2026-10-13T14:49:20.000+02:00, Eliot Lear via swinog swinog@lists.swinog.ch a écrit :
Did anyone have any problems? Seems like it was a big nothing (quite nice). Eliot On 09.10.2026 09:29, Oli Schacher via swinog wrote:
Hi everyone, Just a reminder that the next DNSSEC root Key Signing Key (KSK) rollover is coming up on 11 October 2026. For those operating DNSSEC-validating resolvers, it might be worth double-checking that your resolvers have picked up the new KSK-2024 trust anchor (key tag 38696) through standard software updates or RFC5011. There's a handy test provided by Cloudflare to check whether your resolvers are ready: https://dnstest.dev/ksk-2024/%C2%A0 Cheers, Oli _______________________________________________ swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch
------------------------- _______________________________________________ swinog mailing list -- swinog@lists.swinog.ch To unsubscribe send an email to swinog-leave@lists.swinog.ch
Some problems here with DNSSEC via systemd-resolved because the systemd version of Ubuntu 24.04 doesn't include the new KSK.
Bug report: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2170538
Temporary solution: ```bash apt update apt install dns-root-data mkdir -p /etc/dnssec-trust-anchors.d chown systemd-resolved /etc/dnssec-trust-anchors.d/ ln -sf /usr/share/dns/root.ds /etc/dnssec-trust-anchors.d/root.positive systemctl restart systemd-resolved ```
Jan
Am Tue 13. Oct. 2026, hat Eliot Lear via swinog geschrieben:
Did anyone have any problems? Seems like it was a big nothing (quite nice).
Eliot
On 09.10.2026 09:29, Oli Schacher via swinog wrote:
Hi everyone,
Just a reminder that the next DNSSEC root Key Signing Key (KSK) rollover is coming up on 11 October 2026.
For those operating DNSSEC-validating resolvers, it might be worth double-checking that your resolvers have picked up the new KSK-2024 trust anchor (key tag 38696) through standard software updates or RFC5011.
There's a handy test provided by Cloudflare to check whether your resolvers are ready: https://dnstest.dev/ksk-2024/
Cheers, Oli
-
Eliot Lear -
Jan Fader -
Oli Schacher -
René Luria