Algorand urges node upgrade to 5.0.3 after DNS root key change blocked restarts
Serguey Asael Shinder2 min readThe Algorand developers published go-algorand 5.0.3-stable in the early hours of 12 October with an unusually direct instruction: all node runners should upgrade as soon as possible. The patch fixes a DNSSEC problem that stops nodes of every type from bootstrapping into the network when they are started or restarted.
What broke. Algorand nodes find peers through DNS and, by default, require those DNS answers to be validated with DNSSEC. Validation needs a trust anchor: the public key that signs the DNS root. That key has just changed. According to IANA, which operates the root key, the new root Key Signing Key KSK-2024 has been signing the root zone since 11 October 2026, replacing KSK-2017, which had signed it since 2018. IANA's guidance is that validating resolvers must have the updated trust anchor to keep validating the root. Algorand's node software carried its own anchor file without the new key. The release notes summarise it in one line: "A root key update broke DNSSEC lookups due to anchor updates."
Who is affected. Nodes that were already connected keep working. The failure appears on the next start or restart of any version below 5.0.3: the node cannot validate DNSSEC signatures and so cannot connect. In practice a routine reboot, a crash or a configuration change is enough to take a node off the network.
The fix and the workaround. Version 5.0.3 updates the anchor file to include KSK-2024 (changelog entry #6764). Upgrade paths named in the notes: ./nodekit upgrade for Nodekit users, the package manager for packaged installs, and the FUNC app's node software update. Operators who cannot upgrade immediately can temporarily disable DNSSEC validation by setting "DNSSecurityFlags": 0 in config.json (with a config Version above 33, adding "Version": 34 if needed), and should set it back to 9 after upgrading. The release contains no protocol upgrade.
Why this is worth noting beyond Algorand. The root key rollover was scheduled well in advance: IANA published KSK-2024 in the root zone before it began signing, and resolvers that follow the RFC 5011 automatic update mechanism could start trusting it during that standby period. Software that ships its own copy of the anchor — as Algorand's node did — has to be updated by its maintainers, and its users only find out when something restarts. Other projects that embed DNSSEC validation are worth checking the same way.
Sources: go-algorand 5.0.3-stable release notes — https://github.com/algorand/go-algorand/releases/tag/v5.0.3-stable ; IANA DNSSEC trust anchors — https://www.iana.org/dnssec/files