https://www.icann.org/resources/press-material/release-2026-05-20-en The Internet Corporation for Assigned Names and Numbers (ICANN) today announced that it is planning to change the trust anchor for the Domain Name System (DNS) on 11 October 2026. This change, known as a rollover, is an important step in maintaining the long-term security, stability, and resiliency of the DNS. The trust anchor is formally known as the Domain Name System Security Extensions (DNSSEC) root zone Key Signing Key (KSK). The KSK is the cryptographic key at the core of the DNSSEC trust anchor and is used to verify that DNS responses are legitimate and have not been modified in transit. DNSSEC helps ensure that Internet users receive authentic DNS data when accessing websites and online services. The rollover process replaces the current KSK with a new one, to maintain strong cryptographic security protections across the global DNS. "The trust anchor rollover is a carefully coordinated process that helps safeguard the integrity of the DNS," said Kim Davies, Vice President, Internet Assigned Numbers Authority (IANA) Services and President of Public Technical Identifiers (PTI). "While most Internet users will not notice any change, operators of DNS software should confirm that their systems are properly configured to trust the new key ahead of the rollover." ICANN, through its IANA functions, manages the DNS root zone and coordinates the rollover in collaboration with partners across the global Internet community. To minimize the risk of disruption, ICANN publishes the new KSK well in advance, allowing impacted operators sufficient time to update systems and verify that automated trust anchor update mechanisms function correctly. The rollover process follows a phased implementation timeline that began in 2024 and will conclude in 2027. During this period, both the current and new KSKs remain valid, giving recursive resolvers – the systems operated by Internet service providers, enterprises, and others that look up and verify DNS information on behalf of users – time to adopt the new trust anchor before the new KSK begins signing the root zone in October 2026 and the old key is retired in January 2027. Operators running validating recursive resolvers, particularly those with manually configured trust anchors or older software, are encouraged to review their systems and verify readiness for the rollover. Failure to update systems may result in DNS resolution failures after the rollover date. More information about the KSK rollover, including operational guidance and technical resources, is available at ICANN KSK Rollover Information Page<https://www.icann.org/resources/pages/ksk-rollover-en>.