As of earlier this month, ICANN have started signing the root zone in an offline process (ie not in a live manner). This will gradually be phased in through the course of 2010, starting in January, and culminating in a fully live signed root zone in July 2010. Technically, this means that replies to queries to the root name servers will exceed 512 bytes. This may cause problems for some resolving software that does not support EDNS0, or resolvers that sit behind misconfigured firewalls that arbitrarily enforce a 512 limit on DNS traffic. There are also cases involving the handling of IP fragmentation where problems can occur. You should check that your resolving infrastructure can handle this issue - https://www.dns-oarc.net/oarc/services/replysizetest for a methodology. You may also wish to pass this on to your clients, particularly those who run their own resolving infrastructure, and/or firewalls. Definitive website: http://www.root-dnssec.org/ More details can be found at: http://labs.ripe.net/content/preparing-k-root-signed-root-zone Inpact on end-user kit: http://download.nominet.org.uk/dnssec-cpe/DNSSEC-CPE-Report.pdf Best timeline for events: http://www.ripe.net/ripe/meetings/ripe-59/presentations/abley-signed-root.pdf