Skip to content

CONCEPT Cited by 2 sources

DNSSEC key rollover

Definition

A DNSSEC key rollover is the periodic replacement of the cryptographic keys used to sign a DNS zone's records. Resolvers that validate DNSSEC will only trust answers whose signatures match the currently-published keys — if the keys change and the new signatures don't validate, the resolver assumes the zone has been tampered with and returns SERVFAIL, cutting off access (Source: sources/2026-07-28-cloudflare-q2-2026-internet-disruption-summary).

Key rollovers are routine but critical maintenance. When they go wrong — producing invalid signatures during the transition — the failure is catastrophic at TLD scale because every validating resolver on the Internet is affected simultaneously.

Failure characteristics

  • Blast radius: a TLD key-rollover failure makes every child zone under that TLD unresolvable for validating resolvers worldwide.
  • Counter-intuitive traffic spike: failed answers are uncacheable, so lookups normally served silently from cache must be re-resolved repeatedly, causing a sharp increase in query volume during the outage.
  • Progressive impact: impact climbs steadily over hours as cached records age out; serve-stale (RFC 8767) cushions users while valid cached entries remain.

Seen in

  • DENIC .de key rollover failure (2026-05-05): routine scheduled rollover began producing non-validatable signatures at ~19:30 UTC; every validating resolver returned SERVFAIL for .de queries that missed cache; restored at 23:15 UTC (~4h). Cloudflare 1.1.1.1 deployed a Negative Trust Anchor-equivalent override at 22:17 UTC. (Source: sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage)
  • Albanian .AL key rollover failure (2026-07-14): second TLD-level DNSSEC failure absorbed via NTA within two months of the .de event; triggered the first production deployment of EDE 33 (Negative Trust Anchor) for per-response in-band transparency. (Source: sources/2026-07-14-cloudflare-dnssec-nta-ede-33)
Last updated · 598 distilled / 1,814 read