{"id":30188,"date":"2025-07-02T19:11:08","date_gmt":"2025-07-02T19:11:08","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=30188"},"modified":"2025-07-16T16:36:31","modified_gmt":"2025-07-16T16:36:31","slug":"dns-root-key-signing","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/","title":{"rendered":"DNS Root Key Signing Key Ceremony 57"},"content":{"rendered":"\n

By Hugo Salgado<\/a>, DNS Architect at Tucows Domains<\/p>\n\n\n\n

At the end of April this year, the 57th<\/sup> DNS Root Key Signing Key Ceremony<\/a> took place at the facility on the east coast of the United States. P\u00eda Gruv\u00f6, Ond\u0159ej Filip, Nomsa Mwayenga, and I participated as Cryptographic Officers.<\/p>\n\n\n\n

<\/p>

<\/p>

<\/p>

<\/p>\n\n\n\n

This time, it was a regular process of signing the ZSK which will be published in the third and fourth quarters of the year and will continue with the pre-publication of the new KSK. Since we are currently in the middle of the KSK rollover process<\/a>, we must be careful to generate different scenarios, considering emergency situations such as the retirement of the new KSK. That said, everything appears to be fine for now. A study conducted by Duane Wessels of Verisign shows that resolvers have accepted the new key at a rate of 90% after the month-long wait since it appeared in the root keyset in February 2025 <\/p>\n\n\n\n

\"\"
(Image taken from \u201cThe 2024-2026 Root Zone KSK Rollover: Initial Observations and Early Trends<\/a>\u201d)<\/figcaption><\/figure>\n\n\n\n

A new version of the operating system and HSM control tools, called coen v2.0.1, was used for this 57th<\/sup> ceremony.<\/p>\n\n\n\n

Once again, the ceremony was executed flawlessly. Since becoming a Crypto Officer two years ago, this was the first ceremony with no exceptions to the script!<\/p>\n\n\n\n

In the DNS root keyset, there are now two KSKs [the current (20326) and the new key (38696)], ZSK 53148 and its future replacement, 46441, which is scheduled to appear at the end of June, all signed by the current KSK 20326.<\/p>\n\n\n

Additional reading:<\/div><\/div><\/div>
A Theatrical Plot and a Secret Key: The Remarkable Experience of the DNS Root Zone Signing Ceremony<\/a><\/div><\/div><\/section>\n\n\n

I’d also like to mention that during the recent LACNIC43 meeting held in Sao Paulo, Brazil, I gave a presentation at the Technical Forum on the KSK key rollover. This presentation focused on ISP operators and companies operating DNS resolvers, as they should be aware of the final date in October 2026 and check their systems to verify that they already have the new KSK (either through automatic rotation via RFC5011 or through updates to their operating systems or DNS software). I also took the opportunity to present a beta version of a tool based on the RFC8509 sentinel technique which allows checking whether our DNS provider is ready for the next DNSSEC root key rollover. This tool is available at https:\/\/test.kskroll.vulcano.cl\/<\/a><\/p>\n\n\n\n

A video of the presentation is available on LACNIC’s YouTube channel in Spanish<\/a> and simultaneously interpreted into English<\/a> and Portuguese<\/a>. Click here to download the slides (820KB PDF)<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Hugo Salgado, DNS Architect at Tucows Domains At the end of April this year, the 57th DNS Root Key Signing Key Ceremony took place at the facility on the east coast of the United States. P\u00eda Gruv\u00f6, Ond\u0159ej Filip, Nomsa Mwayenga, and I participated as Cryptographic Officers. This time, it was a regular process […]<\/p>\n","protected":false},"author":6,"featured_media":30193,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1321],"tags":[416],"archivo":[1345,1451],"taxonomy-authors":[1239],"tipo_autor":[],"class_list":["post-30188","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dns-en","tag-dns-en","archivo-editions","archivo-highlights-2023","taxonomy-authors-hugo-salgado-en"],"acf":{"author":"","related_notes":""},"yoast_head":"\nLACNIC Blog | DNS Root Key Signing Key Ceremony 57<\/title>\n<meta name=\"description\" content=\"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LACNIC Blog | DNS Root Key Signing Key Ceremony 57\" \/>\n<meta property=\"og:description\" content=\"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\" \/>\n<meta property=\"og:site_name\" content=\"LACNIC Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/lacnic\" \/>\n<meta property=\"article:published_time\" content=\"2025-07-02T19:11:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-16T16:36:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"330\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gianni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@lacnic\" \/>\n<meta name=\"twitter:site\" content=\"@lacnic\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\"},\"author\":{\"name\":\"Gianni\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\"},\"headline\":\"DNS Root Key Signing Key Ceremony 57\",\"datePublished\":\"2025-07-02T19:11:08+00:00\",\"dateModified\":\"2025-07-16T16:36:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\"},\"wordCount\":418,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png\",\"keywords\":[\"DNS\"],\"articleSection\":[\"DNS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\",\"url\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\",\"name\":\"LACNIC Blog | DNS Root Key Signing Key Ceremony 57\",\"isPartOf\":{\"@id\":\"https:\/\/blog.lacnic.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png\",\"datePublished\":\"2025-07-02T19:11:08+00:00\",\"dateModified\":\"2025-07-16T16:36:31+00:00\",\"description\":\"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png\",\"width\":680,\"height\":330},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/blog.lacnic.net\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DNS Root Key Signing Key Ceremony 57\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.lacnic.net\/#website\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"name\":\"LACNIC Blog\",\"description\":\"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.\",\"publisher\":{\"@id\":\"https:\/\/blog.lacnic.net\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.lacnic.net\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/blog.lacnic.net\/#organization\",\"name\":\"LACNIC Blog\",\"url\":\"https:\/\/blog.lacnic.net\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"contentUrl\":\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg\",\"caption\":\"LACNIC Blog\"},\"image\":{\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/facebook.com\/lacnic\",\"https:\/\/x.com\/lacnic\",\"https:\/\/www.instagram.com\/lacnic\/?hl=es-la\",\"https:\/\/uy.linkedin.com\/company\/lacnic\",\"https:\/\/www.youtube.com\/user\/lacnicstaff\",\"https:\/\/www.lacnic.net\/podcast\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab\",\"name\":\"Gianni\",\"url\":\"https:\/\/blog.lacnic.net\/en\/author\/gianni\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LACNIC Blog | DNS Root Key Signing Key Ceremony 57","description":"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/","og_locale":"en_US","og_type":"article","og_title":"LACNIC Blog | DNS Root Key Signing Key Ceremony 57","og_description":"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.","og_url":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/","og_site_name":"LACNIC Blog","article_publisher":"https:\/\/facebook.com\/lacnic","article_published_time":"2025-07-02T19:11:08+00:00","article_modified_time":"2025-07-16T16:36:31+00:00","og_image":[{"width":680,"height":330,"url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","type":"image\/png"}],"author":"Gianni","twitter_card":"summary_large_image","twitter_creator":"@lacnic","twitter_site":"@lacnic","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#article","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/"},"author":{"name":"Gianni","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab"},"headline":"DNS Root Key Signing Key Ceremony 57","datePublished":"2025-07-02T19:11:08+00:00","dateModified":"2025-07-16T16:36:31+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/"},"wordCount":418,"commentCount":0,"publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","keywords":["DNS"],"articleSection":["DNS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/","url":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/","name":"LACNIC Blog | DNS Root Key Signing Key Ceremony 57","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","datePublished":"2025-07-02T19:11:08+00:00","dateModified":"2025-07-16T16:36:31+00:00","description":"The 57th DNS Root Key Signing Key Ceremony highlights progress in the KSK rollover process, with 90% resolver adoption and new tools in place.","breadcrumb":{"@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#primaryimage","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","width":680,"height":330},{"@type":"BreadcrumbList","@id":"https:\/\/blog.lacnic.net\/en\/dns-root-key-signing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/blog.lacnic.net\/en\/"},{"@type":"ListItem","position":2,"name":"DNS Root Key Signing Key Ceremony 57"}]},{"@type":"WebSite","@id":"https:\/\/blog.lacnic.net\/#website","url":"https:\/\/blog.lacnic.net\/","name":"LACNIC Blog","description":"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.","publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.lacnic.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/blog.lacnic.net\/#organization","name":"LACNIC Blog","url":"https:\/\/blog.lacnic.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","caption":"LACNIC Blog"},"image":{"@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/lacnic","https:\/\/x.com\/lacnic","https:\/\/www.instagram.com\/lacnic\/?hl=es-la","https:\/\/uy.linkedin.com\/company\/lacnic","https:\/\/www.youtube.com\/user\/lacnicstaff","https:\/\/www.lacnic.net\/podcast"]},{"@type":"Person","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab","name":"Gianni","url":"https:\/\/blog.lacnic.net\/en\/author\/gianni\/"}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2025\/07\/firma-raiz-dns.png","jetpack_sharing_enabled":true,"wpml_current_locale":"en_US","wpml_translations":[{"locale":"es_ES","id":30197,"post_title":"Ceremonia 57 de firma de la ra\u00edz del DNS","slug":"firma-raiz-dns","href":"https:\/\/blog.lacnic.net\/firma-raiz-dns\/"},{"locale":"pt_BR","id":30208,"post_title":"Cerim\u00f4nia 57 da assinatura da raiz do DNS","slug":"assinatura-raiz-dns","href":"https:\/\/blog.lacnic.net\/pt-br\/assinatura-raiz-dns\/"}],"_links":{"self":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/30188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/comments?post=30188"}],"version-history":[{"count":7,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/30188\/revisions"}],"predecessor-version":[{"id":30214,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/30188\/revisions\/30214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media\/30193"}],"wp:attachment":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media?parent=30188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/categories?post=30188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tags?post=30188"},{"taxonomy":"archivo","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/archivo?post=30188"},{"taxonomy":"taxonomy-authors","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/taxonomy-authors?post=30188"},{"taxonomy":"tipo_autor","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tipo_autor?post=30188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}