Hi all, A short operational reminder: on Sunday, 11 October 2026, KSK-2024 (key tag 38696) is scheduled to become the sole signer of the root DNSKEY RRset. Validating resolvers that have not accepted this trust anchor may experience widespread resolution failures.
ICANN announcement and guidance: https://www.icann.org/resources/pages/ksk-rollover-en With DNSSEC validation requirements now in effect for TLS CAA/DCV and S/MIME CAA checks, this warrants a readiness check across CA validation infrastructure. Key risks: 1. Issuance disruption: stale trust anchors can cause SERVFAIL responses and interrupt issuance or renewals. Caches may delay symptoms. 2. Incorrect error handling: a trust-anchor validation failure must not be interpreted as "no CAA record" or proof that a domain is unsigned. 3. Non-compliant recovery: disabling DNSSEC or switching to a non-validating resolver is not a compliant workaround for queries subject to mandatory validation. Please check before 11 October: - KSK-2024 is trusted, not merely present or pending, across production and failover validators, including MPIC remote perspectives that perform DNSSEC validation. - Where RFC 5011 is used, its state survives restarts and redeployments. Check container images and custom libraries for outdated trust anchors. - If the key is missing, follow vendor-supported update procedures and verify the trust anchor against IANA's published data. With fewer than 30 days remaining, simply enabling RFC 5011 updates now may not complete its required acceptance waiting period in time. - Monitoring and on-call coverage extend through the rollover and at least the following 48 hours. Note that KSK-2017 is scheduled for revocation in early 2027, a further milestone to track. Best regards, Rollin Yu -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/edbfbff8-659c-42a5-9d34-6c6409f6a044n%40mozilla.org.
