11 Oct
2018
11 Oct
'18
6:41 p.m.
On Thu, Oct 11, 2018 at 11:25:15AM -0400, Viktor Dukhovni wrote:
In case you've not seen this many other places, just a friendly reminder that ICANN is rolling the DNSSEC root KSK today. Make sure your resolver (if it is validating) is ready. If you're forwarding queries to an upstream resolver, you might also check that the upstream is ready.
The new root zone is now live, with the DNSKEY RRset signed with KSK2017 (id 20326), rather than KSK2010 (id 19036):
Before: http://dnsviz.net/d/root/W79zYQ/dnssec/ During: http://dnsviz.net/d/root/W79zmg/dnssec/ After: http://dnsviz.net/d/root/W790GQ/dnssec/
As cached data expires, this should make its way into all working caches over the next day or two.
-- Viktor.