Root DNSSEC trust anchors

The root DNSSEC trust anchor, the Key Signing Key or KSK as it’s called, was rolled, i.e. renewed, on Sunday 2026-10-11. To be precise the key was created two years ago, but it is now used for signing the root DNSKEY resource record set (RRset). I’m not involved in the process, but I am an avid follower, and as such I tooted before the event and after: The second screen shot shows an arrow pointing at 38696 which is the key tag (or key id) of this new key, and dig(1) is showing how it was used to sign the set of DNSKEY resource records. During a discussion on Tuesday which began because of a quite disastrous and currently ongoing failure in the German medical IT infrastructure of Gematik, it turns out that some people I thought would know all about this don’t, so I’ll jot down some notes about how I think it ties in together. Let’s begin with trust anchor; what is that? DNSSEC validation is performed by a recursive resolver which obtains cryptographically signed answers to queries.…