3 ms·

Here’s more actual data on DNSSEC. Spoiler: DNSSEC use is going up; DANE usage is way up: https://stats.dnssec-tools.org/# https://stats.dnssec-tools.org/#

• tptacek 7y ago
  And, as you can see from the breakdown at the bottom of this list, the majority of that growth is in places like .NL, where DNSSEC is almost compulsory. It's not hard to check this for yourself. Just start with a list of the top domains on the Internet; I used the Moz Top 500, but Alexa will do fine. Create a flat text file with one domain per line, then do: for N in `cat file` do; host -t ds $N; done You'll see what I see: First, dozens of .GOV sites have DNSSEC delegations because, until a couple years ago, DNSSEC was mandatory in the USG; that mandate has since been rescinded. Second, excluding those .GOV sites, the entire list of signed domains in the Moz Top 500 is as follows: 000webhost.com addtoany.com berkeley.edu bund.de cloudflare.com cmu.edu europa.eu example.com foxnews.com icann.org ietf.org mediafire.com mozilla.org one.com paypal.com pixabay.com stanford.edu themeforest.net time.com welt.de xfinity.com I note with what I hope is plainly evident glee that while PAYPAL.COM is signed, none of Paypal's subsidiaries, like Braintree or Venmo, are.