Rolling the Root Key - What Happened? October 2026
This is an update to articles I posted in May of this year and a week or so ago immediately prior to the rolling of the Root Key of the DNS on the 11th October. We will again use the KSK Sentinel signal to see which networks have successfully tracked the rolling of the root key. The previous articles describe the KSK Sentinel signal, so I won't reproduce that material here.
Let's start with the big picture and look at the entirety of the collected data drawn from our ad-based measurement network. We'll look at the daily data for the first 16 days in October (Figure 1).
Figure 1 – DNSSEC Validation measurements across the KSK Roll
The shaded area in Figure 1 indicates the period from the start of the KSK Roll (1400 UTC, 11 October 2026) and the ensuring 48-hour period which is the maximal extent of the cached lifetime of the root zone DNSKEY records in validating resolvers (2 days).
The blue trace shows the number of measurements performed each day. The daily variation in measurement ad presentation rates is within the normal daily variation levels.
The red trace shows the percentage of measurements which indicate that the measured user is using only DNSSEC-validating resolvers. Prior to the 11th October this required that the outgoing KSK was trusted by the resolver, and once the locally cached DNSKEY resource record was refreshed, some time before 1400 UTC on the 13th October, a validating resolver would need to trust the incoming KSK to successfully perform a validation operation.
This data indicate that the global average DNSSEC validation rate rose from a pre-roll value of 39.7% to a post-roll value of 40.6%. In global terms this indicates that the KSK was rolled successfully and there was no major DNS outage. This is of course very positive feedback to the work of many parties who have invented, standardized, implemented and deployed DNSSEC validation software in resolvers that tracked this roll of the KSK.
However, averages can often conceal a collection of individual behaviours that deviate from the norm. Let's take a closer look at 2 economies which have a significant population of DNSSEC-validating users (generally due to the use of ISP-provisioned recursive resolvers that perform DNSSEC validation), and see how they fared at a national level over the KSK roll. These economies are India and Brazil (Figure 2).
Figure 2 – DNSSEC Validation measurements across the KSK Roll for Brazil and Japan
We were fortunate in that we could contact a major Indian ISP on the 9th October and alert them to the KSK Sentinel signal that indicated that their resolvers had failed to pick up local trust in the incoming KSK and would likely fail in validation when the KSK rolled, and this ISP was able to react in time. The result was that at a national level the national DNSSEC validation rate for all measured Indian users rose across the KSK roll from some 55% to 59%. We were not so fortunate in attempting to contact ISPs in Brazil in the same period that have the same signal, and the DNSSEC validation rate fell from 54% to 50% after the KSK had rolled.
In the article at the start of this month I included a table of the 50 networks with the lowest rate of acceptance of KSK-2024 over the previous week where we had observed 1,000 or more tests that showed that their DNS resolvers supported the Key Sentinel mechanism.
We've tracked these 50 networks that were listed in the previous article with the lowest rate of acceptance of KSK-2024, and looked at their acceptance rate for the incoming KSK up to the 18th October, as indicated by the Key Sentinel measurements (Figure 3).
Figure 3 – DNSSEC KSK Sentinel measurements for the incoming KSK
Surprisingly, none of these networks were stranded when the KSK rolled. All of the networks added the new KSK to their trusted key set in the period between the 7th and the 13th of October.
I must admit that I was not expecting this. It's unusual to observe that all of these networks that appeared to generate a Key Sentinel signal who were showing an acceptance rate of the incoming KSK below 50% were showing an acceptance rate of more than 50% after the KSK roll. Such a uniform behaviour pattern is somewhat anomalous in the DNS!
Let's now look at DNSSEC validation outcomes across the KSK roll. What we are looking for in the data are those networks whose DNSSEC validation rate fell after the 13th October as compared to the average rate observed in the first 10 days in October. Figure 4 shows the distribution of DNSSEC validation change per network over the KSK roll. Figure 4 – Change in DNSSEC Validation Rate across the KSK Roll
The filter applied here is that we need to see an average of 20 samples per day in both the pre- and post- KSK roll periods. There are 13,538 networks in this data set.
There were 35 networks with a positive change in validation of more than 50% of sample points between the before and after periods. A likely explanation is that these network resolvers had DNSSEC configurations that trusted the incoming KSK, but did not trust the previous incumbent KSK. Widening the selection criteria, there were 594 networks which had a positive increase of 10% or more in DNSSEC validation rates.
On the other side, there were 58 networks where the DNSSEC validation rate fell by 50% or more., and 660 networks where the DNSSEC validation rate fell by 10% or more.
We can estimate the user impact of this KSK roll by using estimates of the population of users ( https://stats.labs.apnic.net/aspop ).
The total estimated total user population who are behind DNSSEC-validating DNS resolvers numbers some 1,700,275,794 users, out of a total of some 4,308,517,174 users. Prior to the KSK roll, this user population of DNSSEC-validating users was 1,654,477,399. Across the KSK roll we observer a net increase of 45M DNSSEC-validating users.
Tables 1 and 2 show the national user populations and the total estimate of DNSSEC-validating users before and after the KSK roll for the countries with the largest change in users.
The DNS is a highly distributed but loosely coupled system. Precise coordination of actions in the DNS is not feasible, so any effort to create a uniform outcome will inevitably encounter a level of variation, and judgements of success (and failure) need to tolerant of such variation. In that light, the measurements we've undertaken support that conclusion that the KSK roll of October 2026 was a success.
The data used for this report can be found in a csv-format file at https://ispcol.potaroo.net//2026-10/ksk-as.csv , and an explanation of the columns in this file are at https://ispcol.potaroo.net//2026-10/ksk-as.txt .
Long term measurement data on DNSSEC validation can be found at https://stats.labs.apnic.net/dnssec
The above views do not necessarily represent the views of the Asia Pacific Network Information Centre.
Loading comments…