[ksk-rollover] Increased DNSKEY queries to the root servers since the KSK-2010 revocation

Chris Thompson cet1 at cam.ac.uk
Tue Feb 12 16:52:33 UTC 2019

On Jan 15 2019, Paul Hoffman wrote:

>Greetings again. Soon after the new DNSKEY RRset was published at 1400 UTC
>on 11 January 2019 with KSK-2010 revoked, there was a noticeable increase
>in ./IN/DNSKEY queries sent to root servers.

[much detail omitted here]

>The ICANN organization is evaluating the traffic at the L-root to try to
>characterize the resolvers that are rapidly asking for the root's DNSKEY
>RRset. From this, we can determine if we are able to help the operators
>of those resolvers to remediate this anomalous behavior. We will also
>share data with other root server operators who are conducting similar
>investigations. The results will be reported when our analysis is complete.

A month on, is there anything more known about this? In particular, for
how long did the increased DNSKEY query rate continue?

Chris Thompson
Email: cet1 at cam.ac.uk

More information about the ksk-rollover mailing list