SYSTEM Cited by 1 source
dnstest.dev¶
dnstest.dev is a Cloudflare-operated DNS diagnostic website. Its
/ksk-2024 test lets anyone check whether the
resolver their browser uses trusts the new DNS root key-signing key
KSK-2024 (key tag 38696) ahead of the October 11, 2026
KSK rollover. (Source:
sources/2026-10-06-cloudflare-the-keys-to-the-internet-change-on-october-11-are-you-ready)
How it works¶
The test uses the RFC 8509 root key trust anchor sentinel protocol — a way
to interrogate a supporting resolver with ordinary DNS queries. Under the
DNSSEC-signed dnstest.dev zone it serves two sentinel names:
root-key-sentinel-is-ta-38696.dnstest.dev— "is key 38696 a trust anchor?"root-key-sentinel-not-ta-38696.dnstest.dev— "is key 38696 not a trust anchor?"
Both names have valid DNSSEC-signed A records. A sentinel-aware validating
resolver validates them, then returns the answer or substitutes SERVFAIL
depending on whether it trusts KSK-2024:
| Query | KSK-2024 trusted | KSK-2024 not trusted |
|---|---|---|
is-ta-38696 |
valid answer | SERVFAIL |
not-ta-38696 |
SERVFAIL |
valid answer |
Avoiding false negatives¶
The site runs additional controls so a null result isn't misread: it checks that an ordinary signed name resolves, that a deliberately-invalid DNSSEC name is correctly rejected, and that the resolver answers a sentinel query for the current root key. If sentinel support can't be established the verdict is inconclusive — which does not mean the new key is missing. The browser test reflects whatever resolver the browser uses (Secure DNS or a VPN can change it); for a pinned check, query systems/cloudflare-1-1-1-1-resolver|1.1.1.1 directly:
(Source: sources/2026-10-06-cloudflare-the-keys-to-the-internet-change-on-october-11-are-you-ready)
Related¶
- concepts/dnssec — the protocol being validated.
- concepts/trust-anchor — what the sentinel queries about.
- systems/cloudflare-1-1-1-1-resolver — the resolver that implements RFC 8509.
- concepts/key-rotation — the KSK-2024 rollover this test prepares for.