“On 4 October 2023 at 07:00 UTC, the DNSSEC signatures in the version of the root zone from 21 September expired.”
The root zone added a ZONEMD record on 21 September as a known, planned change. Cloudflare’s resolver couldn’t parse it and kept serving the old zone for 13 days without anyone noticing. Then the signatures expired and SERVFAILs peaked at 15% of queries. The first alarm was outside users complaining at 7:57.