Summary

  • APNIC’s pre-roll screen singled out 50 networks with low acceptance of the incoming KSK and at least 1,000 supporting tests; by 18 October, every one had recorded acceptance above 50%.
  • The change makes a point-in-time warning useful as a follow-up queue, not as a list of networks that failed or users who lost service.

A signal can be accurate about what it sees and still be wrong as a verdict. Before the DNS root’s Key Signing Key changed on 11 October, APNIC Labs identified 50 networks whose measured acceptance of the incoming key was below 50%. After the change, APNIC reported that all 50 had added the new key between 7 and 13 October and later showed acceptance above 50%. None was left in the state the earlier snapshot had flagged.

That sequence is more instructive than a pass/fail label. Readiness was not a fixed property captured once before a scheduled event. It was a state that moved during a defined interval. The operational question is therefore not simply whether a network was below a threshold on one day. It is whether the signal persisted, whether someone could act on it, and what the measurement showed after the change.

APNIC’s selection rule matters. The 50 networks came from a table of low incoming-key acceptance in the preceding week, with at least 1,000 tests showing support for the Key Signing Key Sentinel mechanism. That threshold makes the observations more interpretable than a handful of probes, but it does not turn a network label into an inventory of every resolver or every person behind it. The signal says what the sampled tests observed under that method.

The timing matters too. The root began using the incoming key at 14:00 UTC on 11 October. APNIC treats the following 48 hours as the period during which resolvers could still be using cached root DNSKEY data. Its follow-up says the 50 networks added the new key over 7–13 October, a window that crosses the signing change. The evidence therefore supports a narrow conclusion: the flagged cohort’s measured acceptance rose across the transition. It does not show whether a given network changed because of routine automated trust-anchor updates, operator action, outside contact, or another cause.

That distinction changes how early-warning systems should be operated. A low reading before a scheduled change can be valuable precisely because there is still time to investigate. But an alert should open a case, not close the analysis. The useful record links the initial signal to its observation window, the affected measurement scope, any contact or configuration action, and a later result. Without that chain, the reader cannot tell whether the warning cleared, the measurement shifted, or the underlying service changed.

The cohort also cautions against treating the threshold itself as an operational failure boundary. “Below 50% acceptance” describes the measured proportion in a defined sample; it does not establish that half of a network’s users lacked a working trust path. A DNSSEC validation failure requires a more specific chain: a validating resolver, an unusable trust-anchor state, and a lookup whose validation fails. APNIC’s Sentinel observations help expose key-state behavior, but they are not a direct outage counter.

This is why the result complements, rather than replaces, the root-zone status. IANA records that the new KSK began signing the root zone on 11 October. That confirms the authoritative transition. APNIC’s sample says how a selected set of observed networks behaved around it. Resolver operators remain the parties able to inspect their local trust-anchor state and service impact. Each layer answers a different question.

APNIC also describes contacting one major Indian ISP before the change after a Sentinel signal indicated that its resolvers had not adopted the incoming key; the report says the measured rate increased across the roll. That example shows that an alert can support timely engagement. It does not establish that outreach explains the movement of all 50 networks. The cohort-wide result has no published causal breakdown, and a single reported intervention should not be expanded into one.

The more useful success measure is thus not whether a pre-roll warning existed, nor whether it later disappeared. It is whether the system can distinguish a transient signal from a persistent condition, route the latter to an accountable operator, and record what changed. In this case, the 50-network cohort moved past the earlier threshold, while the public evidence leaves the mechanism of that movement unresolved. That is not a failure of the measurement. It is the boundary between detection and attribution.

Sources