ICANN to Replace Core DNS Security Key in October 2026

Event summary

  • ICANN will replace the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK) on October 11, 2026.
  • The rollover process began in 2024 and will conclude in January 2027.
  • Operators of DNS software must update systems to trust the new key to avoid resolution failures.
  • ICANN coordinates the rollover with global Internet community partners.

The big picture

The KSK rollover is a critical update to maintain the security and stability of the global DNS. As cyber threats evolve, ensuring the integrity of the DNSSEC trust anchor is vital for preventing DNS spoofing and other attacks. This phased implementation reflects the complexity of coordinating such a foundational change across the Internet infrastructure.

What we're watching

Operational Readiness
How quickly DNS operators adopt the new trust anchor before the October 2026 deadline.
System Compatibility
Whether older DNS software can support the new KSK without manual updates.
Global Coordination
The pace at which ICANN and its partners can mitigate potential disruptions during the rollover.