Out of the blue some DNS queries stopped being resolved and named.log grew in size exponentially whinging about broken trust chains. What the? Turns out that on October 11, 2026, the DNS root changed its key-signing key (KSK) for only the second time ever. This key anchors DNSSEC’s chain of trust, which lets DNS resolvers authenticate answers using cryptographic signatures. The change is called a KSK rollover. Nah, never heard of it 
To fix the issue:
o remove /usr/local/etc/namedb/working/managed-keys.bind and /usr/local/etc/namedb/working/managed-keys.bind.jnl
o restart bind:
To fix the issue:
o remove /usr/local/etc/namedb/working/managed-keys.bind and /usr/local/etc/namedb/working/managed-keys.bind.jnl
o restart bind:
service named restart and an updated key file will be created automatically.
