DNSSEC root key rollover succeeds despite local setbacks

The DNSSEC root key rollover completed without a major global outage, according to measurements reported by APNIC after the change on 11 October 2026. DNS Security Extensions (DNSSEC) let a resolver check that DNS answers are authentic and have not been altered. APNIC's advertisement-based measurement network found that the worldwide share of measured users relying only on DNSSEC-validating resolvers increased from 39.7% before the rollover to 40.6% afterward.

The change began at 14:00 UTC on 11 October. It replaced the root Key Signing Key (KSK), a cryptographic credential used to verify the DNS root's signed records. The root zone sits at the top of the Domain Name System, directing resolvers toward the servers responsible for domains below it. A resolver is the service that looks up the internet address associated with a domain name.

Before the change, validating resolvers needed to trust the outgoing KSK. After refreshing their locally cached DNSKEY resource record, which contains the public information used for DNSSEC verification, they needed to trust the incoming key. Those cached records could remain valid for two days, so the transition period continued until 14:00 UTC on 13 October. A resolver that had not accepted the new key could fail DNSSEC checks, potentially making correctly signed domains appear unavailable to its users.

APNIC examined data from the first 16 days of October. The daily number of measurements stayed within its normal range of variation during the rollover. Although the global result was positive, national averages exposed contrasting outcomes in Brazil and India, where many users rely on DNSSEC-validating recursive resolvers supplied by internet service providers. A recursive resolver performs the sequence of DNS lookups needed to obtain an answer for a user.

APNIC contacted a major Indian ISP on 9 October after the KSK Sentinel signal indicated that its resolvers had not established local trust in the incoming key and were likely to fail after the rollover. KSK Sentinel is a measurement mechanism used to determine whether a resolver trusts a particular root key. The ISP acted before the change, and the measured DNSSEC validation rate among Indian users rose from 55% to 59%. APNIC was unable to reach Brazilian ISPs showing the same warning in that period, and Brazil's measured rate declined from 54% to 50%.

Earlier measurements had identified 50 networks with the lowest acceptance rates for KSK-2024. Each had produced at least 1,000 tests indicating support for KSK Sentinel, while fewer than half of its measurements accepted the incoming key. Follow-up data through 18 October produced an unexpected result: none of those networks was left behind. All 50 added KSK-2024 to their trusted key sets between 7 and 13 October, and each subsequently recorded an acceptance rate above 50%.

APNIC also compared each network's post-roll validation rate with its average over the first 10 days of October. The dataset covered 13,538 networks with an average of at least 20 daily samples in both the before and after periods. Validation increased by more than 50% in 35 networks. APNIC said a likely explanation was that their resolvers trusted the incoming key but not the incumbent key. In total, 594 networks recorded an increase of at least 10%. In the opposite direction, 58 networks lost 50% or more of their validation rate, while 660 declined by at least 10%.

The estimated number of users behind DNSSEC-validating resolvers increased from 1,654,477,399 before the rollover to 1,700,275,794 afterward, out of an estimated total population of 4,308,517,174 users. APNIC described this as a net increase of 45.8 million validating users.

India recorded the largest estimated gain, rising from 321,679,249 to 367,102,609 DNSSEC-validating users, an increase of 45,423,360 from a total user population of 655,274,727. Other estimated increases were Viet Nam, 9,157,450; Algeria, 3,266,261; Morocco, 2,360,854; Kazakhstan, 950,982; Slovakia, 664,669; Iran, 558,706; Thailand, 282,420; Sri Lanka, 263,373; and Lithuania, 208,987. Their respective post-roll validating populations were 32,490,227, 10,692,147, 26,111,432, 7,417,541, 1,767,006, 16,548,704, 29,149,702, 1,870,630 and 838,531.

Brazil had the largest estimated decline, falling from 80,503,978 to 72,723,712 validating users, a loss of 7,780,266 from a total user population of 162,001,400. The other largest estimated drops were the Russian Federation, 3,078,946; China, 1,756,584; the United States, 906,565; Bulgaria, 760,869; Bangladesh, 610,974; Japan, 609,093; Uganda, 329,937; Pakistan, 312,472; and Egypt, 300,999. Their respective post-roll validating populations were 17,668,816, 4,955,581, 98,812,775, 1,002,739, 30,315,215, 15,785,216, 8,834,481, 37,347,439 and 47,290,182.

These figures do not mean every local transition was flawless. DNS is highly distributed and only loosely coordinated, so resolver behaviour naturally differs among networks. APNIC nevertheless concluded that the October 2026 rollover was successful when judged at internet scale. Its measurements show both sides of that result: no major worldwide disruption, but meaningful losses in some networks and economies that failed to maintain validation at previous levels.

For readers choosing an alternative to an ISP's default resolver, AEU DNS offers private, secure DNS for everyone. DNSSEC authenticity and DNS privacy are related but distinct considerations, so users and IT teams should check what their chosen resolver supports and how it maintains its root trust information.