DNS root key rollover · 11 October 2026

ASUS missed
the key.

Websites fail. Images disappear. The connection still works.
A scheduled DNS change exposed stale trust data in current ASUS firmware—and a security feature became the cause of broken browsing.

Jukka Niiranen · · 3 minute read
Investigation snapshot · no router settings changed
Verified ASUS caseTUF Gaming AX6000
Latest published stock firmware3.0.0.4.388_34098
Configuration in this caseLocal DNSSEC + Cloudflare DoT

The page can load.
Its images can fail.

Modern pages load images and other resources from separate hostnames. On 12 October, www.reddit.com resolved through my ASUS router, while preview.redd.it and i.redd.it returned SERVFAIL. The main site’s DNS worked; its image hosts’ DNS did not.

The router’s DNSSEC validator trusted only root key 20326. The root had switched to replacement 38696 the day before. This one-year-old router had the latest stock firmware, but its installed binary and active configuration still lacked the replacement anchor. [1]

This was announced long in advance.

  1. Cloudflare prepares

    Adds the new key to its resolver software. [2]

  2. Key is pre-published

    IANA makes it available in the root zone. [1]

  3. Merlin prepares

    Third-party ASUS firmware adds the anchor. [3]

  4. My ASUS firmware

    Latest stock release. Locally verified: old anchor only. [4]

  5. Root signing changes

    Unprepared validators start failing. [1]

The new key was pre-published for 21 months. The signature algorithm stayed the same. This required current trust data, not more powerful hardware. [5]

The failure is reproducible.

Read-only DNS checks on the same desktop and Internet connection.
Hostname / roleASUS DNS
www.reddit.com
Main site hostname		RESOLVES
preview.redd.it
Reddit image previews		FAILS
i.redd.it
Reddit image hosting		FAILS
nordicsummit.info / espc.tech
Two unrelated website domains		BOTH FAIL

Cloudflare and Google resolve all these hostnames. Query-specific validation bypass also restores the failed router lookups. A failed Reddit preview image returns HTTP 200 when supplied its resolved IP, with normal HTTPS certificate checks. No router setting was changed.

Five additional controls—GitHub, jsDelivr, Microsoft sign-in, Unsplash images and Wikipedia—resolved through the router at this check. Cache expiry and different resource hostnames can make a broken validator look like intermittent website trouble. ICANN describes this delayed failure pattern. [5]

Evidence beyond
this router.

An RT-BE88U owner reports the same defect on ASUS’s ZenTalk forum, including firmware they identify as released on 7 October 2026. They say adding the new anchor to an independent dnsmasq instance restores validation. [6]

A Flint 2 owner reports rollover-related Unbound failures in a configured AdGuard/Unbound stack and says updating the root anchors fixed them. An Ezee Fiber customer reports DNSSEC disablement restoring browsing on 12 October; their router model and root-key state are unspecified. These corroborate the broader problem, not additional verified ASUS models. [10] [11]

Reports are separate from our local tests. I found no ASUS affected-model advisory or repair ETA, and no reliable count of affected customers.

Who was supposed
to maintain the key?

The router uses dnsmasq. Its maintainer’s stated approach is to rely on authenticated software-provider updates for root anchors, rather than built-in automatic key rollover. [7]

ASUS describes DNS Guard as “ensuring secure and authentic DNS resolutions.” The trust data is part of that promise. Customers should not need to inspect cryptographic key IDs to keep an advertised feature working on current firmware. [12]

Scope matters. This case had local DNSSEC enabled. It does not establish failure on untouched factory defaults or every ASUS router. Public ASUS-derived source sets DNSSEC off by default; exact factory state on this model was not tested. Caches can delay failures, making the symptoms look random. ICANN reports no widespread disruption. [8] [5] [9]

Sources & verification notes
  1. IANA: trust anchors & rollover scheduleKey IDs, pre-publication and activation dates.
  2. Cloudflare: preparing for the rolloverNew anchor built into its resolver in July 2024.
  3. Asuswrt-Merlin: primary changelog3006.102.7, 22 February 2026. Separate firmware project.
  4. ASUS: TUF-AX6000 firmware releasesLatest published version checked on 12 October.
  5. ICANN: what to expect during the rolloverPreparation period, unchanged algorithm, cache delays.
  6. ASUS ZenTalk: RT-BE88U customer reportIndependent report; another model was not tested by me.
  7. dnsmasq maintainer: trust-anchor update design2018 explanation of relying on software updates.
  8. Public ASUS-derived defaultsdnssec_enable = 0. Not an audit of every stock firmware.
  9. ICANN: rollover statusNo widespread disruption reported at this check.
  10. Flint 2 owner: root-anchor failure12 October. Configured Unbound stack; AI-assisted customer account.
  11. Ezee Fiber customer: DNSSEC failures12 October. Matching symptoms; hardware and anchor state unknown.
  12. ASUS: its DNS Guard security promiseVendor describes secure and authentic DNS resolution.

Local evidence: read-only firmware/configuration inspection, Windows DNS comparisons and HTTPS checks on 12 October 2026. Failures verified for preview.redd.it, i.redd.it, nordicsummit.info and espc.tech. Other domains listed as controls resolved at that snapshot. The corrected-anchor repair was reported by other customers; it has not been run on this ASUS router. No repair or global incident count is claimed.