CONCEPT Cited by 2 sources
DNSSEC key rollover¶
Definition¶
A DNSSEC key rollover is the periodic replacement of the cryptographic keys used to sign a DNS zone's records. Resolvers that validate DNSSEC will only trust answers whose signatures match the currently-published keys — if the keys change and the new signatures don't validate, the resolver assumes the zone has been tampered with and returns SERVFAIL, cutting off access (Source: sources/2026-07-28-cloudflare-q2-2026-internet-disruption-summary).
Key rollovers are routine but critical maintenance. When they go wrong — producing invalid signatures during the transition — the failure is catastrophic at TLD scale because every validating resolver on the Internet is affected simultaneously.
Failure characteristics¶
- Blast radius: a TLD key-rollover failure makes every child zone under that TLD unresolvable for validating resolvers worldwide.
- Counter-intuitive traffic spike: failed answers are uncacheable, so lookups normally served silently from cache must be re-resolved repeatedly, causing a sharp increase in query volume during the outage.
- Progressive impact: impact climbs steadily over hours as cached records age out; serve-stale (RFC 8767) cushions users while valid cached entries remain.
Seen in¶
- DENIC .de key rollover failure (2026-05-05): routine scheduled rollover began producing non-validatable signatures at ~19:30 UTC; every validating resolver returned SERVFAIL for
.dequeries that missed cache; restored at 23:15 UTC (~4h). Cloudflare 1.1.1.1 deployed a Negative Trust Anchor-equivalent override at 22:17 UTC. (Source: sources/2026-05-06-cloudflare-when-dnssec-goes-wrong-de-tld-outage) - Albanian .AL key rollover failure (2026-07-14): second TLD-level DNSSEC failure absorbed via NTA within two months of the .de event; triggered the first production deployment of EDE 33 (Negative Trust Anchor) for per-response in-band transparency. (Source: sources/2026-07-14-cloudflare-dnssec-nta-ede-33)
Related¶
- concepts/dnssec — the DNS security extension framework
- concepts/negative-trust-anchor — the mitigation primitive for TLD-level DNSSEC failures
- concepts/tld-level-failure-blast-radius — the structural blast radius property
- concepts/dns-resolver-caching — serve-stale as the cushion during failure
- systems/denic — the .de TLD registry
- systems/big-pineapple — Cloudflare's resolver software that absorbed both events