Four times a year, a small group of people unlocks two safes, wakes a metal box with smart cards and, on camera, signs one small file. This animated explainer shows why that strange ritual guards the very top of the internet's address book.

Chapters:

0:00 Intro

0:36 How DNS works: the internet's phone book

1:32 The lie: DNS cache poisoning

2:22 The seal: DNSSEC and the chain of trust

3:17 The vaults in California and Virginia

4:13 The keyholders: Trusted Community Representatives

5:17 Inside a ceremony, step by step

6:14 The machine: hardware security modules

7:12 What the master key actually signs

8:14 The big switch: changing the root key

9:16 Why a ceremony?

• How DNS turns names into numbers, and how cache poisoning tricked it

• DNSSEC signatures and the chain of trust that ends at one root key

• The two key facilities, the trusted community representatives, smart cards, tamper-evident bags and hardware security modules

• Why "seven people hold the keys to the internet" isn't quite true

• The 2018 root key rollover and the next one

• English AI voiceover, original synthesized music and SFX, mixed to -14 LUFS

• Original vector animation, 1080p 60 fps, fact-checked

A calm, fascinating look at one of the hidden machines that run our world.