The Key at the Top of the Internet

Today, Sunday, October 11, one of the most important and least noticed switches on the internet takes effect. The Domain Name System, the global address book that turns names like a website's web address into the numbers computers use, begins relying on a new cryptographic key at its very top. It is only the second time this has happened. The first was exactly eight years ago, on October 11, 2018, and if everything goes as planned, almost no one will notice.

A Chain of Trust, Starting at the Root

The internet's address book was designed in an era when nobody imagined that anyone would lie about an address. A security layer called DNSSEC fixes that by attaching digital signatures to answers, so your device can check that a response hasn't been forged on its way to you. Every one of those checks traces back to a single starting point: the key that signs the root of the DNS. Overseen by ICANN, the nonprofit that coordinates the internet's naming system, this root Key Signing Key was first put into use in 2010. Today, a new key called KSK-2024 replaces its predecessor, KSK-2017, as the only key signing the root's key set. The new key has been quietly sitting in the root zone since January 2025, published but not yet in charge, so that the world's networks had nearly two years to learn to trust it.

Swapping a key like this is a bit like changing the locks on a building while people are still walking through the doors. The switch has been planned carefully, and ICANN reports that more than 95% of resolvers reporting their settings have already added the new key. The few that haven't, mostly older or misconfigured systems that validate DNSSEC, could see lookup failures, and ICANN has published guidance for operators and a fallback for anyone caught off guard. The key itself is protected in an unusual way: ICANN holds ceremonies several times a year at secure facilities, where volunteer "trusted community representatives" from around the world use their own credentials to help activate it. Those ceremonies are separate from today's switch, but they are a big reason the system has earned trust.

The first rollover was originally planned for October 2017, but was postponed a year so network operators had more time to prepare, a reminder that the biggest risk in a change like this is rarely the cryptography and usually the people and systems that have to keep up. Today's change is the second act of that story. Older keys will be formally revoked and removed in early 2027, and ICANN has already floated plans for a longer multi-year move to a different cryptographic algorithm later in the decade. For the vast majority of internet users, the day will pass without a single noticeable event, which is exactly the point. The best infrastructure is the kind you never think about, and today is a rare day when a small group of people made sure of that.