Hi everyone,
On October 11, 2026, ICANN started using a new DNSSEC root key (KSK-2024, 38696), replacing the old key (20326).
This may cause DNS resolution failures on older systems that validate DNSSEC but haven’t received the new key.
If you’re running BIND, Unbound, dnsmasq, or another DNS resolver with DNSSEC validation enabled, it’s worth checking. Older routers and systems with manually configured trust anchors may also be affected.
The symptoms can be confusing: your internet connection works, but websites stop loading because DNS queries fail.
You can quickly test your local resolver:
# Should return NOERROR, ideally with the AD flag
dig @127.0.0.1 cloudflare.com +dnssec +adflag
# Should return SERVFAIL
dig @127.0.0.1 dnssec-failed.org
If you’re affected, update your DNS resolver or router firmware and check that the new trust anchor (38696) is present.
This mainly concerns recursive DNSSEC validation, not DNSSEC signing of domains hosted in Virtualmin.
I recently ran into this with an ASUS router running older Merlin firmware, which was missing the new key.
More details: https://www.icann.org/resources/pages/ksk-rollover-en