isitdns? wiki/Security/KSK roll 2026 board: is your resolver ready for 38696?
Security

KSK roll 2026 board: is your resolver ready for 38696?

ksk
the root zone's signing key
until
20326 (KSK-2017)
oct-11
38696 (KSK-2024) takes over
need
your resolver trusts 38696
if-not
SERVFAIL for every lookup
starts within 48 h of the roll
run
dig @1.1.1.1 . DNSKEY
look
flags 257 are the two KSKs
test
step 1 below
spec
RFC 8509

Step 1: test your resolver#

Run these three names against the resolver you use, with @1.1.1.1 replaced by yours.

dig @1.1.1.1 root-key-sentinel-is-ta-38696.probe.isitdns.net A
dig @1.1.1.1 root-key-sentinel-not-ta-38696.probe.isitdns.net A
dig @1.1.1.1 bogus.probe.isitdns.net A

The first two are the RFC 8509 sentinel pair. The third is signed with a key that no longer exists, so a validating resolver must refuse it. A ready resolver answers the first one like this:

Asks the sentinel name that says whether a resolver trusts root key 38696.

 dig @1.1.1.1 root-key-sentinel-is-ta-38696.probe.isitdns.net A
; <<>> DiG 9.20.11-0ubuntu0.2-Ubuntu <<>> @1.1.1.1 root-key-sentinel-is-ta-38696.probe.isitdns.net A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54785
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;root-key-sentinel-is-ta-38696.probe.isitdns.net. IN A
;; ANSWER SECTION:
root-key-sentinel-is-ta-38696.probe.isitdns.net. 5 IN A 192.0.2.53
;; Query time: 157 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Mon Sep 14 17:42:31 CDT 2026
;; MSG SIZE rcvd: 92

GO NOERROR here and SERVFAIL for the not-ta-38696 twin, the pair RFC 8509 defines

NO GO NOERROR for both names

DO resolver operator: Check the anchors by hand, it has no sentinel support

run this query in the dig tool →

what each part of this output means →

is-tanot-tabogusYour resolver
answersSERVFAILSERVFAILReady
SERVFAILanswersSERVFAILNot ready, or its anchor is under 30 days old (RFC 5011 hold-down). Check before acting
answersanswersSERVFAILValidates, no sentinel support. Check its anchors by hand
answersanswersanswersIt does not validate DNSSEC at all. The roll cannot break it
SERVFAILSERVFAILanyNo verdict. Usually already broken: dnssec-troubleshooting

If port 53 is intercepted where you sit, add +https to each line to ask over DoH.

Step 2: see the public resolvers#

Check the board below, which asks every public resolver this site monitors. Five names per resolver: the sentinel pairs for 38696 and for 20326, and the bogus name. At most 20 minutes old.

live board: /api/ksk (JSON)

dig +short ksk.isitdns.net TXT

Step 3: if yours is not ready#

Fix it by installing KSK-2024 (38696), then run step 1 again and expect Ready.

  1. Take the key from IANA's root-anchors.xml.
  2. Install it where your resolver reads trust anchors. Its own documentation names the place.

Already failing after the roll: Check your resolver for KSK-2024 (RFC 8509).

See also#

  • dnssec: how the trust chain works
  • dnssec-viz: the live chain, both root KSKs drawn