DNSSEC

The root DNSSEC trust key used to secure the internet's domain name system is scheduled to roll over on October 11, 2024. ICANN and IANA are updating the root key signing key, and operators of DNS resolvers must ensure their systems accept the new key or risk failing to validate domain names. Cloudflare published guidance explaining the rollover and how network operators can prepare.

PowerDNS has published guidance on preparing DNSSEC deployments for post-quantum cryptography. The post examines what happens to DNS responses once larger, quantum-resistant signatures are introduced, and how operators can get ahead of the transition. Discussion has focused on the practical challenges of fitting bigger keys and signatures into the DNS protocol's size constraints.