On Thu, Oct 11, 2018 at 11:24:13AM -0400, Viktor Dukhovni wrote: > In case you've not seen this many other places, just a friendly > reminder that ICANN is rolling the DNSSEC root KSK today. Make > sure your resolver (if it is validating) is ready. If you're > forwarding queries to an upstream resolver, you might also check > that the upstream is ready.
The new root zone is now live, with the DNSKEY RRset signed with KSK2017 (id 20326), rather than KSK2010 (id 19036): Before: http://dnsviz.net/d/root/W79zYQ/dnssec/ During: http://dnsviz.net/d/root/W79zmg/dnssec/ After: http://dnsviz.net/d/root/W790GQ/dnssec/ As cached data expires, this should make its way into all working caches over the next day or two. -- Viktor.