IANA has published an update to the trust anchors for DNSSEC at https://www.iana.org/dnssec/files. This update adds a new key that is planned to be used to sign the DNS root zone starting in 2026.

Software vendors and system package maintainers are encouraged to begin their processes for distributing this new trust anchor. The new trust anchor is currently available in a format suitable for constructing a DS record. The file is expected to be expanded in October 2024 to add data for also constructing the associated DNSKEY record.

We plan to pre-publish the new KSK in the DNS starting on 11 January 2025, with a standby period of nearly two years before a rollover in October 2026. This provides ample opportunity to propagate the new trust anchor, and also provides the capability to roll to it sooner should an emergency rollover be required.

Kind regards,

James Mitchell

Director IANA Technical Services

_______________________________________________
ksk-rollover mailing list -- ksk-rollover@icann.org
To unsubscribe send an email to ksk-rollover-leave@icann.org

_______________________________________________
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.