ICANN Publishes New DNSSEC Trust Anchor to Prepare for 2026

The Internet Corporation for Assigned Names and Numbers (ICANN), through the Internet Assigned Numbers Authority functions it facilitates, recently published an update to the trust anchors for Domain Name System Security Extensions (DNSSEC).

DNSSEC trust anchors serve as the ultimate points of trust for the DNSSEC system. DNSSEC secures the DNS by validating authentic domain name data that has not been altered by third parties. Updates to the trust anchors require careful coordination among Internet infrastructure operators to ensure a seamless transition and maintain the security and stability of the DNS.

The recent update adds a new cryptographic key that is planned to be used to sign the DNS root zone starting in 2026. Software vendors and system package maintainers are encouraged to begin their processes for distributing this new trust anchor.

ICANN plans to prepublish the new cryptographic key in the DNS starting on 11 January 2025, with a standby period of nearly two years before a rollover in October 2026. This provides ample opportunity to propagate the new trust anchor and provides the capability to roll over to it sooner should a rollover have to occur on an accelerated timeline.

Operational announcements regarding the rollover are published on the root-dnssec-announce mailing list. Discussion is encouraged on the separate ksk-rollover mailing list.

More information on the rollover is published at https://www.iana.org/dnssec/files.

ICANN's mission is to help ensure a stable, secure, and unified global Internet. To reach another person on the Internet, you need to type an address - a name or a number - into your computer or other device. That address must be unique so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the world. ICANN was formed in 1998 as a nonprofit public benefit corporation with a community of participants from all over the world.