On 6 October 2026, Google revealed that attackers had seized the .gh, .sl and .as registries, rewrote DNS records, and obtained unauthorized HTTPS certificates for Google and several other major brands. Domain owners should monitor Certificate Transparency logs and publish restrictive CAA records, because browser-side blocking does not protect non-browser clients.
On 11 October 2026 the DNS root zone replaces its key-signing key KSK-2017 with KSK-2024, the second rollover since the root was first signed in 2010. Any DNSSEC-validating resolver that does not already trust the new key will stop resolving every name: the job is to find, before Sunday, the resolvers whose trust anchor has been frozen.
September 2026’s Patch Tuesday, the largest in Microsoft’s history, closes a wormable RCE in Windows DNS Server, the first SigRed-class flaw since 2020. Isolate and patch your exposed DNS, DHCP and multicast servers first.
On 16 September 2026, ISC shipped BIND 9.20.29 and 9.21.26, fixing 14 vulnerabilities including DNS cache-poisoning flaws and DNSSEC-validation bypasses. Upgrade exposed recursive resolvers and lock down recursion before a forged response redirects your users.
On September 24, 2026, Manifold Security revealed that third-party.com, a documentation placeholder used as an example for years, had been registered by a third party and now serves a ClickFix lure to Windows browsers. Audit your repositories and stop letting a non-reserved domain stand in as an example.
On September 16, 2026 the ISC shipped BIND 9.20.29 and 9.21.26 to fix 14 vulnerabilities, including CVE-2026-77692, which crashes named with a single malformed DNS-over-HTTPS request. Inventory every resolver, patch, and make resolution redundant before one packet takes your platform down.
The public resolver 1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum algorithm whose every signature weighs 2,420 bytes. It is the first Internet-scale test of carrying oversized DNS responses and blocking downgrade to weakened algorithms.
The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.
On October 11 2026 the DNSSEC root Key Signing Key moves from KSK-2017 to key tag 38696 (KSK-2024), and the old key is retired in January 2027. Operators of validating resolvers must confirm tag 38696 is installed before the cutover, or their DNS resolution will fail wholesale with no network symptom.
The Iranian Cavern C2 framework has added a module that queries DNS to choose between a direct HTTPS channel and a Google Apps Script relay, plus another that turns Microsoft 365 calendars into a dead-drop. For network detection, indicator blocklists are no longer enough: you have to watch for anomalous DNS queries and abuse of legitimate services.
The Human-Centered Computing Foundation has filed its application with ICANN for the .self top-level domain, a namespace designed for self-hosted, human-centered projects. Behind the symbol, the real question is what a domain name can actually guarantee — and whether .self will serve self-hosters or mark them as targets.
Pi-hole v6 and AdGuard Home 0.107.77 are both thriving in 2026, but the comparison has shifted. Native encrypted DNS, per-client rules, and built-in parental controls make AdGuard Home the clear choice for new deployments. If you’re starting today, the gap isn’t close.
As of 2026, nearly all DNS traffic still travels unencrypted over your ISP’s network, where it gets packaged and sold to programmatic ad exchanges. DoH, DoT, and the new DoH3 protocol make that surveillance technically impossible.
