DNSSEC Trust Anchors and Rollovers

The Root Key Signing Key (KSK) acts as the trust anchor for DNSSEC for the Domain Name System. This trust anchor is configured in DNSSEC-aware resolvers to facilitate validation of DNS data.
This page contains data on the trust anchors for the DNS, as well as information on operational plans to change these keys (events known as key rollovers).
IANA distributes an XML file containing the details of the trust anchor set, which validating resolvers can use to verify DNS root zone data. A description of these files and considerations for updating the trust anchor are described in DNSSEC Trust Anchor Publication for the Root Zone (RFC 9718).
Validators should keep this data up-to-date. Consider the following:
IANA provides a standalone tool that retrieves the root trust anchors and verifies their accuracy, providing the root zone trust anchors in both DS and DNSKEY formats.
The process of changing the signing key is known as a rollover. Rollovers are an important process in the management of DNSSEC, ensuring the ongoing security of the protocol as the cryptographic landscape evolves. Important dates regarding the current rollover are shown below:
We plan an idealized three-year rollover interval, publishing the key in the DNS for about two years in a standby state before the rollover. Generation of the successor key follows each rollover.
The three-year rollover strikes a responsible balance ensuring that procedures and software remain sufficiently agile to adopt new keys as they are commissioned, while not introducing too much operational complexity through overly-frequent changes to the KSK. The standby period will allow a lengthy pre-publication and consequently allow for the new KSK's earlier use if there is a need to expedite a rollover. More information on the schedule and motivation is available in our Proposal for Future Root Zone KSK Rollovers.
This table provides information on the keys generated for Root Zone KSK operations. Software implementers should rely on the XML trust anchors file for normative parameters on keys.
Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list. A separate ksk-rollover mailing list is a forum for discussion specific to rollovers.
Major updates will also be communicated through ICANN’s announcement channels.
The IANA functions coordinate the Internet’s globally unique identifiers, and are provided by Public Technical Identifiers, an affiliate of ICANN.