DNS Key signing key change

General
1

On October 11, 2026, the DNS root is scheduled to change its key-signing key (KSK). Will this change affect pihole or unbound?

2

The new key that will be used starting 2026-10-11 is the KSK-2024, which was published on 2024-07-26.
You can check /etc/pihole/dnsmasq.conf on your Pi-hole machine and will find the following lines:

# 2024-07-26 root zone trust anchor
# https://www.iana.org/reports/2024/root-ksk-2024.pdf
trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

The key got added to FTL with release v6.0, so no action is required as a user unless you run an unsupported older version.

3

This is similarly true for unbound. Just make sure your root.key is reflecting the updated entry with the same id: 38696 (ksk). Shouldn't be an issue since this is a well known process and happens regularly.

4

For Debian like systems, that would be below one:

$ sudo unbound-control get_option auto-trust-anchor-file
/var/lib/unbound/root.key

Which gets created with below helper script:

$ systemctl cat unbound.service
[..]
ExecStartPre=-/usr/libexec/unbound-helper root_trust_anchor_update

Which sources below file:

$ cat /usr/libexec/unbound-helper
[..]
DNS_ROOT_KEY_FILE="/usr/share/dns/root.key"

Which is part of below APT package:

$ dpkg -S root.key
dns-root-data: /usr/share/dns/root.key

With below changelog entry:

$ apt changelog dns-root-data
[..]
dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

 -- Marco d'Itri <md@linux.it>  Sun, 17 Nov 2024 21:57:17 +0100
5

Anyone interested in how that goes about (EDIT: bit dated though :wink: ):

6

Whatever happens I will fix it so thank you for the notification that something could break if I am unlucky :joy:

Considering the age of my Pi-Hole v6 + Unbound installation I should be fine... mind the 'should'... LOL!

7

Grep for it:

grep 20326 /var/lib/unbound/root.key

EDIT: Or:

grep --quiet 20326 /var/lib/unbound/root.key && echo "Got the key" || echo "Dont have the key"

EDIT2: Or more precise:

grep --quiet 20326 $(sudo unbound-control get_option auto-trust-anchor-file) && echo "Got the key" || echo "Dont have the key"