Summary

  • ICANN reported on 15 October that the planned root-zone key signing key transition completed on 11 October, when KSK-2024 took over signing from KSK-2017.
  • The old key has not yet reached its scheduled revocation and removal, and ICANN says reports affecting a limited number of systems remain under assessment; the notice does not establish causation.

Completion has a narrower meaning than closure

The root DNSSEC key changed on schedule. That is the event ICANN reported on 15 October: KSK-2024 is now signing the root zone, while KSK-2017 is no longer doing so. The public status is clear enough to describe the cryptographic handoff. It is not a certificate that every resolver has completed its own trust-anchor update, nor does it close the rest of the key’s lifecycle.

IANA’s trust-anchor schedule makes the distinction concrete. KSK-2017 remains a valid trust anchor after it stops signing. IANA lists 11 January 2027 for publishing the old key with the RFC 5011 REVOKE signal, then 22 March 2027 for removing it from the root zone. The sequence gives validating resolvers that follow the automated update mechanism a defined revocation stage before removal.

ICANN’s notice also records an unresolved operational question. The organization says it is aware of reports affecting a limited number of systems following the transition and is assessing their potential relationship to it. That wording is narrower than either “the rollover caused failures” or “the rollout was issue-free.” The notice provides no count, system inventory or causal finding. It says monitoring will continue through the remaining milestones.

For operators, the immediate distinction is between the signer visible in the root zone and the trust anchor held by each validating resolver. IANA says resolvers need current trust anchors to continue validating the root. A scheduled transition can therefore be complete at the zone while individual deployments still require observation. The sources reviewed here do not provide a global readiness measurement, and the existence of issue reports alone cannot supply one.

The governance test is whether the public record keeps those states separate. “Completed as planned” describes the signing-key change. Revocation, removal and any evidence-based assessment of reported issues remain separate entries with separate dates. Treating them as one completion label would make the status easier to announce but less useful to the people responsible for local validation.

Sources