Overview

The following DNSSEC deployment statics come from the work of Viktor Dukhovni (Two Sigma), published by Wes Hardaker (USC/ISI) as part of the DNSSEC-Tools project.

Last Updated: Thu Jan 17 04:47:02 2019

Summary Statistics

The current numbers from the DANE/DNSSEC survey are:

Total number of DS Resource Record Sets:
8880137
Total number of working DNSKEYs:
8740266

DANE Trend graphs

Domains with signed MX and DANE records

The following graph depicts the number of domains that have deployed DANE/SMTP. Specifically, their zone is signed, their MX records all point to hosts that have DANE TLSA records.

Zones Hosting DANE Mail Servers

Many of the domains in the previous graph outsource or aggregate their mail servers such that the MX records point to out-of-domain mail servers (i.e. externally hosted mail servers). This graph depicts the number of mail servers that have DANE records deployed for them.

DNSSEC Deployment Statistics

The following tables summarize the deployment size and states of various DNSSEC parameters.

Parameter frequency

DNSKEY parameter frequency (1000 or more instances), by zone count:

KSK

kskalgsflagsprotoalg
463725733
25817825735
219998625737
403412025738
212975257310
1968276257313
61005257314

ZSK

zskalgsflagsprotoalg
463725633
2568825635
218609425637
396873925638
212792256310
892175256313
60108256314

RSA key size distribution

RSA key size distribution (1000 or more instances), by zone count:

KSK

kskdomainsbits
683024096
50131422048
3040861536
32761280
13157741024
7870512

ZSK

zskdomainsbits
132064096
1101252048
3062451280
60887511024
8105512

RSA exponent distribution

domainsexponent
6694564\x010001
12444\x0100000001
438\x03
47\xff39
34\x40000003
19\xffff

Breakdown by TLD of secure delegations

This table shows the number of delegations with DS records (and thus indicating the subzone is signed). The table also shows the number of succesful DNSKEY lookups for domains under the given TLD, meaning the number of zones that the DNSKEYs within the subzone could be both retrieved and verified as authentic with DNSSEC. Note that reasons failure include both failures in DNS itself for the subzone (e.g. no reachable name servers) or because DNSSEC validation of the results failed.

(Only TLDs are considered where the number of securely delegated subzones is greater than 999)

TLDworkingtotal-DS%working
br51726751749599.96
xn--j6w193g2650265299.92
hk155421555599.92
one137961381799.85
mx164831651899.79
is2103210899.76
app399104000899.76
ovh212642132899.70
fr40883441066399.55
art1784179299.55
lu1052105799.53
re3599361899.47
paris2775279199.43
nl3082096310003599.42
de915869213299.41
bzh1472148199.39
no38190338440699.35
studio1091109999.27
agency1284129499.23
immo1634164799.21
hu11953612051199.19
pro1631164599.15
tv3426345899.07
ee1634165198.97
ch638266451298.94
cz60949861610698.93
be15444415627698.83
eu48827349440898.76
biz196951994398.76
cloud4334438998.75
gov1138115398.70
bank2663269998.67
info407794134398.64
online7989810198.62
world1772179798.61
se58980959834498.57
pt119691214698.54
io150311527498.41
mobi1109112798.40
nu956539727398.33
org9959810128598.33
design1145116598.28
tech3759382698.25
me8851901098.24
store2804285798.14
cc1390141798.09
nz1059108098.06
amsterdam5167527397.99
net13512513794797.95
us7642780597.91
fi3440351697.84
kr3745382997.81
dk236852423597.73
com1001768102505497.73
at6301647497.33
site2139219897.32
li1111114397.20
it1799185197.19
club1990204897.17
uk323153327997.10
email1979204196.96
ca3075317896.76
es177961843396.54
pl44985546655896.42
shop112971172896.33
space1310136096.32
xyz6429668596.17
co5615584796.03
frl3976414795.88
lv3401356595.40
ro991104494.92
au1218129194.35
in2780296193.89
ru2791304891.57
nrw2240247190.65