Korea Internet & Security Agency (KISA) said on the 7th that, as the Internet Corporation for Assigned Names and Numbers (ICANN) will replace the key-signing key (KSK) for Domain Name System Security Extensions (DNSSEC) of the root zone at 1 a.m. on Oct. 12, it is urging domestic cache domain name system (DNS) server operators to conduct pre-checks.
A cache DNS is a system that finds and connects an actual internet address (IP address) when an internet user enters a domain name. The top-level information needed to find addresses is provided by the Root Zone, which contains the information required to look up addresses for top-level domains such as .kr and .com. Domain Name System Security Extensions (DNSSEC) is a technology that verifies whether such information has been tampered with. The key-signing key (KSK) is the cryptographic key that serves as the trust anchor for that verification.
ICANN periodically replaces the key-signing key to maintain the security of the root zone. This replacement is the second since DNSSEC was first applied to the root zone in 2010. The new cryptographic key has been used alongside the existing key since Jan. 2025, and starting Oct. 12 only the new key will be used to sign the root zone.
Cache DNS servers that have not incorporated the new key by the replacement time will be unable to resolve any domain addresses within about 48 hours after 1 a.m. on Oct. 12. In addition, users of the relevant domain name system servers will be unable to access internet services.
Accordingly, cache DNS operators, including internet service providers (ISPs), must check in advance whether the new key has been incorporated. In particular, PowerDNS software does not have an automatic key update function, so institutions using that product must verify that they are running the version (5.2.0) that incorporates the new key.
Detailed procedures for updating DNSSEC keys can be found on the Korea Internet & Security Agency (KISA) Korea Network Information Center website.
Park Jeong-seop, director of the KISA Korea Network Information Center, said, "About 95% worldwide have already incorporated the new key, so the likelihood of a large-scale internet outage is low," adding, "However, localized internet access disruptions may occur on some servers using outdated versions or where automatic updates are not functioning properly, so we ask operators to be sure to check in advance whether the new key has been incorporated."