{"id":14237,"date":"2026-09-17T06:00:38","date_gmt":"2026-09-17T13:00:38","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=14237"},"modified":"2026-09-17T04:02:12","modified_gmt":"2026-09-17T11:02:12","slug":"you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/","title":{"rendered":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026"},"content":{"rendered":"<h3>Introduction<\/h3>\n<p>If your outbound recursive DNS infrastructure is performing DNS Security Extensions (DNSSEC) validation (and if it isn\u2019t, it probably should be), then you need to be aware of the upcoming rollover of the DNSSEC key-signing key (KSK) for the root zone on October 11, 2026. If this is new information to you, then you may be inclined to ask, what is the root zone key, and why do I care about it rolling over? If that is you, fear not, because I\u2019m here to provide those answers and, if you happen to be an Infoblox customer, walk through what you need to do to be fully prepared.<\/p>\n<h3>Root Zone Key Review<\/h3>\n<p>To start, we\u2019ll assume you are already familiar with what DNSSEC provides (data authenticity and integrity, but NOT encryption), and what signing and validating are. If you aren\u2019t acquainted with those concepts, there are many resources available on the internet to get you up to speed. With that out of the way, let\u2019s briefly cover what the root zone KSK is, where it comes from, and why it\u2019s important. We will skip over some of the technical minutiae and focus on what you need to know for this upcoming event.<\/p>\n<h3>What Is the Root Zone KSK?<\/h3>\n<p>For DNSSEC-signed zones, there are usually two keys, a zone-signing key (ZSK) and a key-signing key (KSK). These keys are published in the zone as DNSKEY records. The ZSK is used to sign the resource record sets present in the zone, and the KSK is used to sign just the DNSKEY resource record set for the zone. A core component of DNSSEC is the concept of a chain of trust when it comes to validating DNS responses. The chain starts with what is called the \u201ctrust anchor,\u201d which is a public key that has been explicitly configured as trusted in the validating DNS server and matches a DNSKEY (or DS) resource record present in the DNS zone the anchor is configured for (usually the root zone). Of the two types of keys, it is important to know that KSKs are used as trust anchors.<\/p>\n<h3>Where Does the Root KSK Come From?<\/h3>\n<p>There are multiple organizations (such as ICANN) and several individuals involved in generating and using the root KSK. There is a very formal, open and independently audited process for conducting signings with the root key, known as a Key Signing Ceremony. The individuals are involved in the ceremony as experts representing different areas of the technical community, and they each provide some component required to access the KSK, such as keys or smart cards. ICANN has an <a href=\"https:\/\/www.icann.org\/en\/blogs\/details\/the-key-to-the-internet-and-key-ceremonies-an-explainer-11-07-2023-en\" target=\"_blank\"><strong>article<\/strong><\/a> that provides further details on the keys and ceremonies.<\/p>\n<h3>Why Is the Root KSK Important?<\/h3>\n<p>All validation within a validating DNS server is dependent upon the configured trust anchor(s); therefore, if the KSK for the Internet root zone is changed and the validating resolver is not aware of the new key, then after the rollover, DNSSEC validation will fail for all signed zones. Therefore, keeping up to date with the latest root KSK is an important part of a DNS administrator\u2019s job when DNSSEC validation is being performed by the system. Fortunately, ICANN does a terrific job planning and publicizing such an important key rollover. For example, the new root KSK was created in April of 2024, first published by ICANN in July 2024, and it was added to the root zone on January 11, 2025, 21 months before the rollover.<\/p>\n<h3>What Do I Need to Do?<\/h3>\n<p>To address the main question you likely have at this point, what you need to do depends greatly on what type of DNS server(s) you are responsible for. For the purpose of this article, I\u2019m going to focus only on the actions required for Infoblox customers. If you are using other products, you should consult information from your DNS platform vendor. The specific actions will depend on which Infoblox products you happen to be using.<\/p>\n<ul class=\"list-spacing\">\n<li><strong>Infoblox Threat Defense\u2122:<\/strong> For Threat Defense, no actions are necessary; Infoblox manages the underlying keys for the recursive DNS service.<\/li>\n<li><strong>Infoblox Universal DDI\u2122:<\/strong> For Universal DDI customers, Infoblox generally manages the root trust anchors on your behalf (unless you manually configure root trust anchors in your configuration for some reason). Configuration bundles generated after July 2026 will have the new key automatically added to them, so administrators should validate that a new config bundle has been applied to their on-prem devices before October. For example, if an administrator updated their global configuration, the new keys would be added to the bundle for that configuration change. In addition, Infoblox expects to be able to force-push configuration updates to add the keys in September.<\/li>\n<li><strong>NIOS:<\/strong> For NIOS customers, there are a few things that the administrator will need to do, so we will run through those in detail.<\/li>\n<\/ul>\n<h3>NIOS Preparation for Root KSK Rollover 2026<\/h3>\n<p>If you are using NIOS as your DNSSEC validating resolver, then you have two options to add the new trust anchor alongside the existing one before October 11. The first is to apply the NIOS hotfix designed to update the trust anchor that is available from the Infoblox knowledge base <a href=\"https:\/\/support.infoblox.com\/s\/article\/DNSSEC-Root-Zone-KSK-Rollover-2026\" target=\"_blank\"><strong>article<\/strong><\/a>. The second is to manually add the new trust anchor. One quick note, because this requires a DNS service restart, please follow the appropriate change control procedures, if any, applicable to your environment. For those that wish to take care of it themselves, let\u2019s walk through the pre-rollover actions step by step:<\/p>\n<ul class=\"list-spacing\">\n<li>Get the root trust anchors from IANA. While I could give them to you, it is a best practice to get it from the <a href=\"https:\/\/www.iana.org\/dnssec\/files\" target=\"_blank\"><strong>source<\/strong><\/a>.\n<ul class=\"list-spacing\">\n<li>Note that the key tag (sometimes referred to as \u201ckey id\u201d) for the new key is 38696, versus the old 20326 (for KSK-2017).<\/li>\n<li>You can see the key tag (labeled as \u201ckey id\u201d) if you query for the root DNSKEY records via the command: <span class=\"code-format\">dig . dnskey +multiline<\/span><\/li>\n<\/ul>\n<\/li>\n<li>Log in to your Grid Manager interface and navigate to Data Management -&gt; DNS, and from the toolbar on the right side select the button for Grid DNS Properties.<\/li>\n<p><img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image1.png\"><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image2.png\"><\/p>\n<li>If you do not see DNSSEC in the list on the left side of the pop-up window, select the button near the top on the left side to Toggle Advanced Mode on, and when you can see DNSSEC, select that.<\/li>\n<p><img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image3.png\"><br \/>\n<img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image4.png\"><\/p>\n<li>In the <em>DNSSEC<\/em> section, scroll down to where you see <em>TRUST ANCHORS<\/em>, and if both <em>Enable DNSSEC<\/em> at the top and <em>Enable DNSSEC<\/em> validation just above the trust-anchor heading are checked then you should see an entry for the zone \u201c.\u201d, which represents the root zone.\n<ul class=\"list-spacing\">\n<li>NOTE: If you don\u2019t see any trust anchors listed, then you aren\u2019t currently performing validation, because you can\u2019t validate without at least one trust anchor. In that case, you will need to add both trust anchors to the configuration if you want to start performing validation.<\/li>\n<\/ul>\n<\/li>\n<li>Press the + button for the trust anchors panel, which will add a new line for a trust anchor.<\/li>\n<p><img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image5.png\"><\/p>\n<li>For the Zone, put in \u201c.\u201d, make sure that Secure Entry Point is checked, make sure that Responses Must Be Secure is NOT checked, select the correct algorithm, RSA\/SHA-256 (8), and then add the new trust anchor information in the Public Key field.\n<ul class=\"list-spacing\">\n<li>NOTE: It is critical that the <em>Responses Must Be Secure<\/em> box is not checked, because if it is, then all queries for non-signed zones will fail, and, unfortunately, the internet isn\u2019t quite ready for that yet.<\/li>\n<p><img decoding=\"async\" src=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/you-dont-need-a-locksmith-image6.png\">\n<\/ul>\n<\/li>\n<li>Click Save &amp; Close.<\/li>\n<li>When the restart banner appears, restart services.<\/li>\n<li>After the restart, try looking up a domain name in a zone that you know is signed and ensure that it is validated properly, by ensuring the \u201cad\u201d flag is present in the dig output.\n<ul class=\"list-spacing\">\n<li>One example query you could use: <span class=\"code-format\">dig @&lt;DNS server IP&gt; www.ietf.org. +dnssec<\/span><\/li>\n<li>Thus, if your DNS server is 192.0.2.100, it would look as follows: <span class=\"code-format\">dig @192.0.2.100 www.ietf.org. +dnssec<\/span><\/li>\n<li>If there is a problem with the configuration, it would manifest as a SERVFAIL response to that query along with any other queries for domain names in signed zones.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>NIOS Post-Rollover Cleanup<\/h3>\n<p>As a part of the rollover, the old root KSK, KSK-2017, will stop signing the root zone in October. KSK-2017 is scheduled to be marked as revoked in January 2027 and removed from the root zone thereafter. Any changes to this would be announced on ICANN\u2019s <a href=\"https:\/\/www.icann.org\/resources\/pages\/ksk-rollover-en\" target=\"_blank\"><strong>KSK Rollover<\/strong><\/a> page, so that is worth watching.<\/p>\n<p>Assuming everything is rolled over successfully, at some point between November and January you should remove the KSK-2017 trust anchor from your NIOS configuration to avoid wasting DNS server resources on an expired key. This can be done by simply navigating to the Grid DNSSEC Trust Anchor configuration (see above) and instead of adding a trust anchor, deleting the old one (please double-check it is the old one you are removing, the first 10 characters of KSK-2017 are AwEAAaz\/tA), clicking Save &amp; Close and restarting services (as noted above, please follow any applicable change procedures).<\/p>\n<h3>Will There Be Future Root KSK Rollovers?<\/h3>\n<p>While this upcoming rollover is important, it is also important to take into account that there will be other rollover events in the future, with ICANN roughly targeting a three-year rollover cadence. Given that target, the next rollover would likely be in 2029. It is also worth noting that there is a proposal working through the community process to shift from the current RSA-SHA256 algorithm (algorithm 8) to ECDSA P-256 with SHA-256 (algorithm 13) instead, which would also require a rollover. If ICANN moves forward with the algorithm change, the algorithm rollover could be aligned with one of the target KSK rollover windows. The details of future rollover events are outside the scope of this article, but it is good to be aware that there will be future events you will also need to recognize and prepare for.<\/p>\n<h3>Conclusion<\/h3>\n<p>Hopefully now you have a better understanding of what the upcoming root KSK rollover is, why it is important and what you may (or may not) need to do to be prepared for it. If you have any questions, please reach out to your Infoblox account team for further information.<\/p>\n<style>\n.code-format {\nfont-family: 'Courier New';}.image-caption {    font-size: 12px;}.list-spacing li{margin-bottom:20px}ol.list-spacing > li::marker {    font-weight: 700;}.entry-content ul.list-spacing ul > li {    list-style-type: square;}<\/style>\n<p><script>\njQuery('.single h1').html('<span class=\"gradient\">You Don\u2019t Need a Locksmith<\/span>: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026');\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction If your outbound recursive DNS infrastructure is performing DNS Security Extensions (DNSSEC) validation (and if it isn\u2019t, it probably should be), then you need to be aware of the upcoming rollover of the DNSSEC key-signing key (KSK) for the root zone on October 11, 2026. If this is new information to you, then you [&hellip;]<\/p>\n","protected":false},"author":438,"featured_media":14238,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[30,1890,229,1891],"class_list":{"0":"post-14237","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-company","8":"tag-dns","9":"tag-root-zone","10":"tag-dnssec","11":"tag-ksk","12":"entry"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026<\/title>\n<meta name=\"description\" content=\"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026\" \/>\n<meta property=\"og:description\" content=\"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T13:00:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"612\" \/>\n\t<meta property=\"og:image:height\" content=\"408\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ross Gibson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026\" \/>\n<meta name=\"twitter:description\" content=\"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ross Gibson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/\"},\"author\":{\"name\":\"Ross Gibson\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/691ef60032472f35cc5fc06a7e0a0ef7\"},\"headline\":\"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026\",\"datePublished\":\"2026-09-17T13:00:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/\"},\"wordCount\":1716,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/dont-need-a-locksmith-thumbnail.jpeg\",\"keywords\":[\"DNS\",\"Root Zone\",\"DNSSEC\",\"KSK\"],\"articleSection\":[\"Company\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/\",\"name\":\"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/dont-need-a-locksmith-thumbnail.jpeg\",\"datePublished\":\"2026-09-17T13:00:38+00:00\",\"description\":\"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/dont-need-a-locksmith-thumbnail.jpeg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/dont-need-a-locksmith-thumbnail.jpeg\",\"width\":612,\"height\":408},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/company\\\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Company\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/company\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/691ef60032472f35cc5fc06a7e0a0ef7\",\"name\":\"Ross Gibson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ross-gibson-image-96x96.jpg\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ross-gibson-image-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/ross-gibson-image-96x96.jpg\",\"caption\":\"Ross Gibson\"},\"description\":\"Ross Gibson is a principal global subject matter expert at Infoblox, where he advises organizations worldwide on DNS architecture, global server load balancing, DNS security and critical network services. He is a co-author of NIST SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide, and of the book The Hidden Potential of DNS in Security. His expertise spans critical network services, including DNS, DHCP and IPAM, as well as routing, switching and network security. Prior to joining Infoblox, Ross was the lead platform engineer for DNS and DHCP at Capital One. He is based in Richmond, Virginia.\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/ross-gibson\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026","description":"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/","og_locale":"en_US","og_type":"article","og_title":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026","og_description":"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.","og_url":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/","og_site_name":"Infoblox Blog","article_published_time":"2026-09-17T13:00:38+00:00","og_image":[{"width":612,"height":408,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","type":"image\/jpeg"}],"author":"Ross Gibson","twitter_card":"summary_large_image","twitter_title":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026","twitter_description":"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.","twitter_image":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","twitter_misc":{"Written by":"Ross Gibson","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/"},"author":{"name":"Ross Gibson","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/691ef60032472f35cc5fc06a7e0a0ef7"},"headline":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026","datePublished":"2026-09-17T13:00:38+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/"},"wordCount":1716,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","keywords":["DNS","Root Zone","DNSSEC","KSK"],"articleSection":["Company"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/","url":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/","name":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key Signing Key (KSK) Rollover in October 2026","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","datePublished":"2026-09-17T13:00:38+00:00","description":"This blog addresses the upcoming root zone KSK rollover scheduled for October 11, 2026. It provides information about what the rollover is and what Infoblox administrators need to do in order to be prepared for it.","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dont-need-a-locksmith-thumbnail.jpeg","width":612,"height":408},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/company\/you-dont-need-a-locksmith-preparing-for-the-root-zone-key-signing-key-ksk-rollover-in-october-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Company","item":"https:\/\/www.infoblox.com\/blog\/category\/company\/"},{"@type":"ListItem","position":3,"name":"You Don\u2019t Need a Locksmith: Preparing for the Root Zone Key-Signing Key (KSK) Rollover in October 2026"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/691ef60032472f35cc5fc06a7e0a0ef7","name":"Ross Gibson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ross-gibson-image-96x96.jpg","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ross-gibson-image-96x96.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/ross-gibson-image-96x96.jpg","caption":"Ross Gibson"},"description":"Ross Gibson is a principal global subject matter expert at Infoblox, where he advises organizations worldwide on DNS architecture, global server load balancing, DNS security and critical network services. He is a co-author of NIST SP 800-81 Rev. 3, Secure Domain Name System (DNS) Deployment Guide, and of the book The Hidden Potential of DNS in Security. His expertise spans critical network services, including DNS, DHCP and IPAM, as well as routing, switching and network security. Prior to joining Infoblox, Ross was the lead platform engineer for DNS and DHCP at Capital One. He is based in Richmond, Virginia.","url":"https:\/\/www.infoblox.com\/blog\/author\/ross-gibson\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/14237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/438"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=14237"}],"version-history":[{"count":6,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/14237\/revisions"}],"predecessor-version":[{"id":14250,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/14237\/revisions\/14250"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/14238"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=14237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=14237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=14237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}