Summary

  • At 15:32 UTC, A, B, L and M returned tag 38696; all four returned it again at about 16:09 UTC.
  • A 12:11 UTC sample still showed tag 20326, KSK-2017’s identifier, at A and M and at two public recursive services. These are snapshots, not a global survey.

The signature moved ahead of the status page

The rollover first appeared as a scheduled date. By 15:32 UTC on 11 October, it was visible in the DNS answer itself. Direct TCP queries without recursion to root-server names A, B, L and M returned the root DNSKEY set with an RRSIG bearing tag 38696. IANA maps that tag to KSK-2024 and 20326 to KSK-2017. A repeat about 37 minutes later returned tag 38696 at all four names again.

At 12:11 UTC, A and M, along with 1.1.1.1 and 8.8.8.8, still showed 20326. In the later sample, A and M showed 38696, as did B and L. The repeated A and M views place a change in those observed answers between the samples. They do not identify the exact operational switch or cover every anycast site and recursive resolver. The signature’s 00:00 UTC inception field marks validity, not a per-server change log.

The RRSIG covers the DNSKEY set used to validate the root’s keys. Seeing KSK-2024 sign that set proves what the queried authoritative answers returned. It does not show that every validating resolver has added 38696 to its local trust anchors, or that any user experienced a validation failure.

At 15:32 UTC, IANA’s public page still labelled KSK-2024 “Pre-Publication” and KSK-2017 “Active.” A cache-revalidated direct retrieval at 16:09 UTC said KSK-2024 was now signing and listed it as “Active” since 11 October; KSK-2017 was “Post-Publication.” The public record changed between captures, though the exact update time is unknown. APNIC’s 9 October post treated signing as upcoming. This report records the observed change without implying resolver-wide readiness.

ICANN’s 11 October reminder asks resolver operators to verify tag 38696 in their trust-anchor configuration rather than assume automatic updates worked. That test is local. IANA schedules KSK-2017’s revocation for 11 January 2027 and removal for 22 March; the observed signature does not establish either later step.

By about 16:09 UTC, A, B, L and M returned 38696 again, and IANA listed KSK-2024 as Active and KSK-2017 as Post-Publication. The samples do not measure recursive trust-anchor adoption, validation failures or user impact.

Sources

APNIC’s 9 October report; IANA’s root trust-anchor and rollover schedule; ICANN’s 11 October resolver-operator reminder. The DNSKEY readings are direct observations at the named root-server addresses.