Overview

The following DNSSEC deployment statics come from the work of Viktor Dukhovni (Two Sigma), published by Wes Hardaker (USC/ISI) as part of the DNSSEC-Tools project.

Note: click on column names to sort the table.

Last Updated: Sat Jan 25 04:47:59 2020

Summary Statistics

The current numbers from the DANE/DNSSEC survey are:

Total number of DS Resource Record Sets:
10656145
Total number of working DNSKEYs:
10537054

DNSSEC Trend Graphs

The following graph depicts the number of signed delegations from public suffix list domains in our dataset.

DANE Trend graphs

Domains with signed MX and DANE records

The following graph depicts the number of domains that have deployed DANE/SMTP. Specifically, their zone is signed, their MX records all point to hosts that have DANE TLSA records.

Zones Hosting DANE Mail Servers

Many of the domains in the previous graph outsource or aggregate their mail servers such that the MX records point to out-of-domain mail servers (i.e. externally hosted mail providers). This graph depicts the number of DNS mail provider zones that have DANE records deployed for them.

DS Record count growth

The following graph shows the growth of observed DS record sets over time (i.e. the number of signed zones):

DNSSEC Deployment Statistics

The following tables summarize the deployment size and states of various DNSSEC parameters.

Parameter frequency

DNSKEY parameter frequency (1000 or more instances), by zone count:

KSK

kskalgsflagsprotoalg
28658925735
221855525737
378061025738
254921257310
3920417257313
86288257314

ZSK

zskalgsflagsprotoalg
2584025635
220111025637
371059325638
254764256310
2371955256313
79183256314

RSA key size distribution

RSA key size distribution (1000 or more instances), by zone count:

KSK

kskdomainsbits
692944096
55101162048
168181536
42091280
9407051024
7804512

ZSK

zskdomainsbits
303744096
4942742048
235381280
56365091024
7638512

RSA exponent distribution

domainsexponent
6514453\x010001
27538\x0100000001
291\x03
159\xff39
25\x40000003
18\xffff

Breakdown by TLD of secure delegations

This table shows the number of delegations with DS records (and thus indicating the subzone is signed). The table also shows the number of succesful DNSKEY lookups for domains under the given TLD, meaning the number of zones that the DNSKEYs within the subzone could be both retrieved and verified as authentic with DNSSEC. Note that reasons failure include both failures in DNS itself for the subzone (e.g. no reachable name servers) or because DNSSEC validation of the results failed.

(Only TLDs are considered where the number of securely delegated subzones is greater than 999)

TLDworkingtotal-DS%working
[signed-graph] [percent-graph] boston95209520100.00
[signed-graph] [percent-graph] bible12111211100.00
[signed-graph] [percent-graph] br58036658059099.96
[signed-graph] [percent-graph] xn--j6w193g3263326599.94
[signed-graph] [percent-graph] is2248225199.87
[signed-graph] [percent-graph] ovh193031933199.86
[signed-graph] [percent-graph] hk166201665299.81
[signed-graph] [percent-graph] mx164341646799.80
[signed-graph] [percent-graph] lu1954195899.80
[signed-graph] [percent-graph] sk11350611381999.73
[signed-graph] [percent-graph] ee9102913099.69
[signed-graph] [percent-graph] bzh1514152099.61
[signed-graph] [percent-graph] fr39696339865899.57
[signed-graph] [percent-graph] de21834721935299.54
[signed-graph] [percent-graph] re3660367999.48
[signed-graph] [percent-graph] fi8566861299.47
[signed-graph] [percent-graph] be30730730898099.46
[signed-graph] [percent-graph] icu5009503799.44
[signed-graph] [percent-graph] paris2612262799.43
[signed-graph] [percent-graph] art2227224099.42
[signed-graph] [percent-graph] nl3163878318350099.38
[signed-graph] [percent-graph] dk22434022579099.36
[signed-graph] [percent-graph] no39794740083099.28
[signed-graph] [percent-graph] ch10013410089899.24
[signed-graph] [percent-graph] app457404609099.24
[signed-graph] [percent-graph] academy1009101799.21
[signed-graph] [percent-graph] page1021103099.13
[signed-graph] [percent-graph] pl47675948144499.03
[signed-graph] [percent-graph] tv4452449799.00
[signed-graph] [percent-graph] eu50577051094498.99
[signed-graph] [percent-graph] hu12423512554598.96
[signed-graph] [percent-graph] studio1376139198.92
[signed-graph] [percent-graph] cz68496369267398.89
[signed-graph] [percent-graph] pro2908294298.84
[signed-graph] [percent-graph] live2196222398.79
[signed-graph] [percent-graph] family1105111998.75
[signed-graph] [percent-graph] amsterdam4555461898.64
[signed-graph] [percent-graph] life1193121098.60
[signed-graph] [percent-graph] gov1184120198.58
[signed-graph] [percent-graph] co245962497798.47
[signed-graph] [percent-graph] dev302683075998.40
[signed-graph] [percent-graph] mobi1350137298.40
[signed-graph] [percent-graph] name1041105898.39
[signed-graph] [percent-graph] biz206022094098.39
[signed-graph] [percent-graph] bank2271231098.31
[signed-graph] [percent-graph] org12140012352198.28
[signed-graph] [percent-graph] se72644873917998.28
[signed-graph] [percent-graph] cloud6488660298.27
[signed-graph] [percent-graph] agency1523155298.13
[signed-graph] [percent-graph] info485744952098.09
[signed-graph] [percent-graph] it9690987998.09
[signed-graph] [percent-graph] nu10271210475098.05
[signed-graph] [percent-graph] shop9016919998.01
[signed-graph] [percent-graph] rocks1180120498.01
[signed-graph] [percent-graph] nz1546157897.97
[signed-graph] [percent-graph] io181361852297.92
[signed-graph] [percent-graph] me125631283797.87
[signed-graph] [percent-graph] digital997101997.84
[signed-graph] [percent-graph] com1483685151681097.82
[signed-graph] [percent-graph] net16450816820897.80
[signed-graph] [percent-graph] cc2576263497.80
[signed-graph] [percent-graph] tech5000511397.79
[signed-graph] [percent-graph] us98121004097.73
[signed-graph] [percent-graph] at124371273597.66
[signed-graph] [percent-graph] space2372242997.65
[signed-graph] [percent-graph] best1856190197.63
[signed-graph] [percent-graph] network1476151297.62
[signed-graph] [percent-graph] nrw2239229697.52
[signed-graph] [percent-graph] immo1615165797.47
[signed-graph] [percent-graph] work1115114497.47
[signed-graph] [percent-graph] kr3561365597.43
[signed-graph] [percent-graph] pw1019104697.42
[signed-graph] [percent-graph] blog1123115397.40
[signed-graph] [percent-graph] world2445251197.37
[signed-graph] [percent-graph] solutions1116114797.30
[signed-graph] [percent-graph] link1057108797.24
[signed-graph] [percent-graph] one150241545797.20
[signed-graph] [percent-graph] uk387223986597.13
[signed-graph] [percent-graph] store3745385797.10
[signed-graph] [percent-graph] pt98521015996.98
[signed-graph] [percent-graph] design1401144596.96
[signed-graph] [percent-graph] xyz182501882596.95
[signed-graph] [percent-graph] li1594164596.90
[signed-graph] [percent-graph] site3394350496.86
[signed-graph] [percent-graph] cat1344139096.69
[signed-graph] [percent-graph] email2718281296.66
[signed-graph] [percent-graph] online124671290996.58
[signed-graph] [percent-graph] es188591956596.39
[signed-graph] [percent-graph] ca5590580296.35
[signed-graph] [percent-graph] club2907304395.53
[signed-graph] [percent-graph] website1221128295.24
[signed-graph] [percent-graph] in3931412995.20
[signed-graph] [percent-graph] ru3770399294.44
[signed-graph] [percent-graph] frl3610382494.40
[signed-graph] [percent-graph] ro1411149694.32
[signed-graph] [percent-graph] au1677180692.86
[signed-graph] [percent-graph] lv3295361791.10

Thank you to data contributors!

We thank the following organizations that have submitted data that helped make these statistics possible: