DNSSEC

Cloudflare is warning that the cryptographic root key that anchors the DNSSEC trust chain — the so-called key signing key maintained by ICANN and IANA — is scheduled to roll over on October 11, 2024. Operators of resolvers and networks that hard-code the root trust anchor are being urged to update their software before the change, or risk DNS resolution failures. The rollover is a routine but sensitive procedure, following a 2017 rollover that caused outages for some misconfigured systems.

PowerDNS has published a post on preparing DNSSEC for post-quantum cryptography, outlining how the authoritative and recursive DNS software can be readied for quantum-resistant signing algorithms. The discussion centers on how the DNS security standard will need to evolve as quantum computers threaten current cryptographic assumptions, a growing concern for internet infrastructure operators.