CCloud Releases
Home
Following

Cloud Releases

Service catalogues and updates come from each provider's public product listing and announcements.

Explore

  • Home
  • Latest updates
  • Following

About

  • About
  • Contact
  • Privacy Policy
  • Terms of Use

Providers

  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud
  • Cloudflare

Not affiliated with any cloud provider. Product names and logos belong to their owners.

  1. Providers
  2. ›Cloudflare
  3. ›1.1.1.1 (DNS Resolver)
  4. ›Update

Feature•Sep 24, 2026

RFC 8509 root key trust anchor sentinel support

1.1.1.1 (DNS Resolver)Cloudflare · Consumer services

1.1.1.1 now supports RFC 8509 root key trust anchor sentinels. They let you check whether the responding resolver trusts a DNSSEC root key ahead of a key rollover.

To check for KSK-2024 (key tag 38696), query DNSSEC-signed names in dnstest.dev:

# On a sentinel-aware resolver that trusts KSK-2024: # Returns NOERROR with an A answer. dig @1.1.1.1 root-key-sentinel-is-ta-38696.dnstest.dev. A +noall +comments +answer # Returns SERVFAIL without an answer. dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +noall +comments +answer # CD bypasses sentinel processing and returns the original A answer. dig @1.1.1.1 root-key-sentinel-not-ta-38696.dnstest.dev. A +cdflag +noall +comments +answer

For background on DNSSEC validation, refer to DNSKEY.

Read the original announcement↗

More from 1.1.1.1 (DNS Resolver)

All 1.1.1.1 (DNS Resolver) updates →

  1. Improved DoH JSON formatting for additional record types

    Cloudflare is rolling out updated formatting for the data field in the 1.1.1.1 DoH JSON API ( application/dns-json ). During the roll out responses may use either the old or new format.

    1.1.1.1 (DNS Resolver)•Feature•Jul 28, 2026