October root key roll adds an estimated 45.8m DNSSEC-validating users

The October change to a key at the top of the internet’s domain-name system left an estimated 45.8 million more users behind resolvers that validate DNSSEC, a check on signed domain-name records. In a 21 October APNIC Blog analysis, the author put the global validation rate at 40.6% after the change, up from 39.7% before it. The author concluded that the roll succeeded without a major DNS outage, while the country and network figures show that not everyone shared the gain. The assessment is the author’s, not necessarily APNIC’s.

The author estimated that 1,700,275,794 of 4,308,517,174 users were behind DNSSEC-validating resolvers after the roll, compared with 1,654,477,399 before it. These are estimates of users served by such resolvers, not a count of people whose individual lookups were tested.

The author used an advertisement-based measurement network. Its signal identifies measurements indicating that a user relies only on DNSSEC-validating resolvers; estimated user-population figures were then used to assess the roll’s impact.

Why the key change mattered

The root key-signing key, or KSK, is a key that validating resolvers must trust to check the DNS root’s signing keys. A resolver is a service that looks up domain names for users; DNSSEC, short for Domain Name System Security Extensions, lets it check signed DNS records. Before the roll, successful validation required trust in the outgoing KSK. The new roll began at 14:00 UTC on 11 October 2026. Once a resolver refreshed its cached root key records during the following 48 hours, it needed to trust the incoming KSK instead.

The author says a warning signal showed that a major Indian internet provider’s resolvers had not yet trusted the incoming key. After an alert on 9 October, the provider reacted before the roll; the measured validation rate among Indian users rose from 55% to 59%. Attempts to contact Brazilian providers showing the same signal were unsuccessful, the author says, and Brazil’s measured rate fell from 54% to 50%. The post does not name the Indian provider or the Brazilian providers.