About

This page documents the results of scanning the DNS to measure the growth of DNSSEC and DANE over time. The scanning is performed by Viktor Dukhovni (Two Sigma), with support from USC/ISI for scanning infrastructure. Wes Hardaker (USC/ISI) produces this web page converts the resulting data into the following charts and tables as part of the DNSSEC-Tools project. For further information, please see the project description page.

We believe that the survey is for the benefit of both you and the Internet. We scan the Internet for DNSSEC and DANE related growth and problems, letting operators (like you) know when we detect problems. To achieve this goal, we ask that SMTP connections from the survey not be blocked.

Scanning OPT-OUT information: we scan both DNS records and DANE/TLS/SMTP servers from the dnssec-stats.ant.isi.edu host. If you wish to be added to our Out-Out list for your domain name(s) or IP address(es), please contact ant-dnssec-operators@isi.edu and include the IP addresses and/or names that you wish to be added to the opt-out list.

Explore the data

For administrators that want greater details about the results of our recent scan of your DNSSEC signed domain, please see our explore page. You can see the results, along with any DNSSEC and DANE issues, our scanner found in the last 24 hours.

Results Table of contents

Note: click on column names to sort the table.

Last Updated: Wed Sep 23 04:48:20 2020

Summary Statistics

The current numbers from the DANE/DNSSEC survey are:

Total number of DS Resource Record Sets:
12550340
Total number of working DNSKEYs:
12416829

DNSSEC Trend Graphs

The following graph depicts the number of signed delegations from public suffix list domains in our dataset.

DANE Trend graphs

Domains with signed MX and DANE records

The following graph depicts the number of domains that have deployed DANE/SMTP. Specifically, their zone is signed, their MX records all point to hosts that have DANE TLSA records.

Zones Hosting DANE Mail Servers

Many of the domains in the previous graph outsource or aggregate their mail servers such that the MX records point to out-of-domain mail servers (i.e. externally hosted mail providers). This graph depicts the number of DNS mail provider zones that have DANE records deployed for them.

DS Record count growth

The following graph shows the growth of observed DS record sets over time (i.e. the number of signed zones):

DNSSEC Deployment Statistics

The following tables summarize the deployment size and states of various DNSSEC parameters.

Parameter frequency

DNSKEY parameter frequency (1000 or more instances), by zone count:

KSK

kskalgsflagsprotoalg
31892625735
213332725737
507851425738
265903257310
4483241257313
112232257314
114432257315

ZSK

zskalgsflagsprotoalg
2640625635
213285725637
497941125638
265770256310
2649504256313
79454256314
114413256315

RSA key size distribution

RSA key size distribution (1000 or more instances), by zone count:

KSK

kskdomainsbits
772704096
70654222048
144901536
46411280
6322791024
8371512

ZSK

zskdomainsbits
428724096
5410482048
214531280
67906641024
8421512

RSA exponent distribution

domainsexponent
7768539\x010001
29477\x0100000001
228\x03
138\xff39
22\x40000003
11\xffff

Breakdown by TLD of secure delegations

This table shows the number of delegations with DS records (and thus indicating the subzone is signed). The table also shows the number of succesful DNSKEY lookups for domains under the given TLD, meaning the number of zones that the DNSKEYs within the subzone could be both retrieved and verified as authentic with DNSSEC. Note that reasons failure include both failures in DNS itself for the subzone (e.g. no reachable name servers) or because DNSSEC validation of the results failed.

(Only TLDs are considered where the number of securely delegated subzones is greater than 999)

TLDworkingtotal-DS%working
[signed-graph] [percent-graph] page491884919999.98
[signed-graph] [percent-graph] vc3161316299.97
[signed-graph] [percent-graph] br63968263994899.96
[signed-graph] [percent-graph] bible1302130399.92
[signed-graph] [percent-graph] xn--j6w193g3801380599.89
[signed-graph] [percent-graph] is2318232199.87
[signed-graph] [percent-graph] ovh193801941299.84
[signed-graph] [percent-graph] hk167501678699.79
[signed-graph] [percent-graph] llc1842184699.78
[signed-graph] [percent-graph] mx171761722399.73
[signed-graph] [percent-graph] uno1083108699.72
[signed-graph] [percent-graph] ee155141556699.67
[signed-graph] [percent-graph] fr40687540830899.65
[signed-graph] [percent-graph] lu2473248299.64
[signed-graph] [percent-graph] be33294233421799.62
[signed-graph] [percent-graph] education1475148199.59
[signed-graph] [percent-graph] re3691370899.54
[signed-graph] [percent-graph] paris2569258399.46
[signed-graph] [percent-graph] nl3298618331736699.43
[signed-graph] [percent-graph] bzh1570157999.43
[signed-graph] [percent-graph] cam1360136899.42
[signed-graph] [percent-graph] de22772322907499.41
[signed-graph] [percent-graph] dev468064709199.39
[signed-graph] [percent-graph] fyi1050105799.34
[signed-graph] [percent-graph] academy1831184499.30
[signed-graph] [percent-graph] business1548155999.29
[signed-graph] [percent-graph] studio3744377299.26
[signed-graph] [percent-graph] ch12436612529899.26
[signed-graph] [percent-graph] pl39822340120999.26
[signed-graph] [percent-graph] co560825650399.25
[signed-graph] [percent-graph] games1408141999.22
[signed-graph] [percent-graph] community1407141899.22
[signed-graph] [percent-graph] fi105391062299.22
[signed-graph] [percent-graph] family2254227299.21
[signed-graph] [percent-graph] app598716036799.18
[signed-graph] [percent-graph] consulting1441145399.17
[signed-graph] [percent-graph] care1399141199.15
[signed-graph] [percent-graph] no41821442182299.14
[signed-graph] [percent-graph] pm1030103999.13
[signed-graph] [percent-graph] pro3973400999.10
[signed-graph] [percent-graph] systems1197120899.09
[signed-graph] [percent-graph] support1131114299.04
[signed-graph] [percent-graph] sk13575413707999.03
[signed-graph] [percent-graph] gov1210122299.02
[signed-graph] [percent-graph] cz70017970725499.00
[signed-graph] [percent-graph] eu48165348667098.97
[signed-graph] [percent-graph] art3827386898.94
[signed-graph] [percent-graph] media1851187198.93
[signed-graph] [percent-graph] live4338438598.93
[signed-graph] [percent-graph] org22021522270098.88
[signed-graph] [percent-graph] dk26134426431698.88
[signed-graph] [percent-graph] tv5008506698.86
[signed-graph] [percent-graph] bank2394242298.84
[signed-graph] [percent-graph] ca222642252698.84
[signed-graph] [percent-graph] us234552374198.80
[signed-graph] [percent-graph] sg1138115298.78
[signed-graph] [percent-graph] nz2541257398.76
[signed-graph] [percent-graph] nrw2264229398.74
[signed-graph] [percent-graph] services1391140998.72
[signed-graph] [percent-graph] biz252942563998.65
[signed-graph] [percent-graph] uk14238214432598.65
[signed-graph] [percent-graph] amsterdam4274433698.57
[signed-graph] [percent-graph] network2790283198.55
[signed-graph] [percent-graph] life2476251498.49
[signed-graph] [percent-graph] se75439076605898.48
[signed-graph] [percent-graph] at153271556998.45
[signed-graph] [percent-graph] best3389344398.43
[signed-graph] [percent-graph] mobi1498152298.42
[signed-graph] [percent-graph] com2477806251842498.39
[signed-graph] [percent-graph] info662506734998.37
[signed-graph] [percent-graph] cloud7656778498.36
[signed-graph] [percent-graph] team1126114598.34
[signed-graph] [percent-graph] group2111214798.32
[signed-graph] [percent-graph] net24344324762198.31
[signed-graph] [percent-graph] wtf1044106298.31
[signed-graph] [percent-graph] news1336136098.24
[signed-graph] [percent-graph] io224982290898.21
[signed-graph] [percent-graph] nu11106211312098.18
[signed-graph] [percent-graph] name1166118898.15
[signed-graph] [percent-graph] ninja1204122798.13
[signed-graph] [percent-graph] hu12633312876998.11
[signed-graph] [percent-graph] solutions1998203798.09
[signed-graph] [percent-graph] it9174935998.02
[signed-graph] [percent-graph] me167881712798.02
[signed-graph] [percent-graph] company2714277297.91
[signed-graph] [percent-graph] agency2541259697.88
[signed-graph] [percent-graph] one177141811097.81
[signed-graph] [percent-graph] rocks1979202497.78
[signed-graph] [percent-graph] in111671142497.75
[signed-graph] [percent-graph] email4076417297.70
[signed-graph] [percent-graph] cc3778386797.70
[signed-graph] [percent-graph] world3471355397.69
[signed-graph] [percent-graph] cat3718380697.69
[signed-graph] [percent-graph] today1306133897.61
[signed-graph] [percent-graph] design2986306097.58
[signed-graph] [percent-graph] link1278131097.56
[signed-graph] [percent-graph] tech7618780997.55
[signed-graph] [percent-graph] pw1648169097.51
[signed-graph] [percent-graph] shop127561308597.49
[signed-graph] [percent-graph] space3469356097.44
[signed-graph] [percent-graph] blog1786183397.44
[signed-graph] [percent-graph] store6205637197.39
[signed-graph] [percent-graph] brussels1076110597.38
[signed-graph] [percent-graph] online219352252797.37
[signed-graph] [percent-graph] es264442718197.29
[signed-graph] [percent-graph] digital1649169697.23
[signed-graph] [percent-graph] kr3141323197.21
[signed-graph] [percent-graph] work1374141896.90
[signed-graph] [percent-graph] club5464564896.74
[signed-graph] [percent-graph] pt9524985896.61
[signed-graph] [percent-graph] immo1822188696.61
[signed-graph] [percent-graph] site5548575896.35
[signed-graph] [percent-graph] li1740181495.92
[signed-graph] [percent-graph] xyz281092932895.84
[signed-graph] [percent-graph] fun1527159695.68
[signed-graph] [percent-graph] au2319244195.00
[signed-graph] [percent-graph] website1783188094.84
[signed-graph] [percent-graph] top1061112394.48
[signed-graph] [percent-graph] lv3466367594.31
[signed-graph] [percent-graph] frl3337354394.19
[signed-graph] [percent-graph] ru4594488494.06
[signed-graph] [percent-graph] ro1750187593.33

Thank you to data contributors!

We thank the following organizations that have submitted data that helped make these statistics possible: