# DNS Key signing key change

**URL:** <https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880>\
**Category:** General\
**Created:** [October 10, 2026, 12:22am UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880 "2026-10-10T00:22:23Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dherkes](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dherkes/32/24793_2.png) [@dherkes](https://discourse.pi-hole.net/u/dherkes)\
**Post date:** [October 10, 2026, 12:22am UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/1 "2026-10-10T00:22:23Z")

</div>

On October 11, 2026, the DNS root is scheduled to change its key-signing key (KSK). Will this change affect pihole or unbound?

---

<div class="post-metadata">

**Author:** ![darkexplosiveqwx](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/darkexplosiveqwx/32/45118_2.png) [@darkexplosiveqwx](https://discourse.pi-hole.net/u/darkexplosiveqwx)\
**Post date:** [October 10, 2026, 3:09pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/2 "2026-10-10T15:09:43Z")

</div>

The new key that will be used starting 2026-10-11 is the KSK-2024, which was published on 2024-07-26.  
You can check `/etc/pihole/dnsmasq.conf` on your Pi-hole machine and will find the following lines:

```bash
# 2024-07-26 root zone trust anchor
# https://www.iana.org/reports/2024/root-ksk-2024.pdf
trust-anchor=.,38696,8,2,683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16

```

The key got added to FTL with release v6.0, so no action is required as a user unless you run an unsupported older version.

---

<div class="post-metadata">

**Author:** ![tomporter518](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/tomporter518/32/3504_2.png) [@tomporter518](https://discourse.pi-hole.net/u/tomporter518)\
**Post date:** [October 10, 2026, 3:21pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/3 "2026-10-10T15:21:17Z")

</div>

This is similarly true for unbound. Just make sure your root.key is reflecting the updated entry with the same id: 38696 (ksk). Shouldn't be an issue since this is a well known process and happens regularly.

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [October 10, 2026, 4:48pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/4 "2026-10-10T16:48:24Z")

</div>

> [@dherkes](#):
>
> unbound

> [@darkexplosiveqwx](#):
>
> KSK-2024

For Debian like systems, that would be below one:

```auto
$ sudo unbound-control get_option auto-trust-anchor-file
/var/lib/unbound/root.key

```

Which gets created with below helper script:

```auto
$ systemctl cat unbound.service
[..]
ExecStartPre=-/usr/libexec/unbound-helper root_trust_anchor_update

```

Which sources below file:

```auto
$ cat /usr/libexec/unbound-helper
[..]
DNS_ROOT_KEY_FILE="/usr/share/dns/root.key"

```

Which is part of below APT package:

```auto
$ dpkg -S root.key
dns-root-data: /usr/share/dns/root.key

```

With below **changelog** entry:

```auto
$ apt changelog dns-root-data
[..]
dns-root-data (2024071801) unstable; urgency=medium

  * Actually add the DNSKEY record for KSK-2024, which was not distributed
    in release 2024071800 because it is not yet published in the root zone.
  * Replace the parser of the root-anchors.xml file with a new one which
    follows RFC 7958bis and will output all valid and not expired DS and
    DNSKEY records, no matter if they are currently published in the root
    zone or not.
  * Document the package in README.Debian. (Closes: #995890)

 -- Marco d'Itri <md@linux.it> Sun, 17 Nov 2024 21:57:17 +0100

```

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [October 10, 2026, 5:13pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/5 "2026-10-10T17:13:51Z")

</div>

Anyone interested in how that goes about (EDIT: bit dated though 😉 ):

[![](https://discourse-cdn.pi-hole.net/uploads/default/original/3X/4/3/433ebffba7717ea763de9551b9a14c107569d1c3.jpeg "Who holds the seven keys to the internet?") ](https://www.youtube.com/watch?v=fUJM9tTvCG4)

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [October 10, 2026, 5:56pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/6 "2026-10-10T17:56:50Z")

</div>

Whatever happens I will fix it so thank you for the notification that something could break if I am unlucky 😂

Considering the age of my Pi-Hole v6 + Unbound installation I should be fine... mind the 'should'... LOL!

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [October 10, 2026, 6:56pm UTC](https://discourse.pi-hole.net/t/dns-key-signing-key-change/87880/7 "2026-10-10T18:56:30Z")

</div>

Grep for it:

`grep 20326 /var/lib/unbound/root.key`

EDIT: Or:

`grep --quiet 20326 /var/lib/unbound/root.key && echo "Got the key" || echo "Dont have the key"`

EDIT2: Or more precise:

`grep --quiet 20326 $(sudo unbound-control get_option auto-trust-anchor-file) && echo "Got the key" || echo "Dont have the key"`