3 ms·

DNSSEC deployment is growing steadily: https://stats.dnssec-tools.org/images/totalds.svg https://stats.dnssec-tools.org/tld-graphs/com.png https://stats.

DNSSEC deployment is growing steadily: https://stats.dnssec-tools.org/images/totalds.svg https://stats.dnssec-tools.org/tld-graphs/com.png https://stats.dnssec-tools.org/tld-graphs/net.png https://stats.dnssec-tools.org/tld-graphs/org.png https://stats.dnssec-tools.org/tld-graphs/biz.png https://stats.dnssec-tools.org/tld-graphs/info.png https://stats.dnssec-tools.org/tld-graphs/us.png The USA is #2 behind Germany by number of DANE-enabled MX host IPs: https://mail.sys4.de/pipermail/dane-users/2020-April/000553.html The USA is not always the best practice to emulate. Microsoft's SMTP servers host mail for at least 284k (today's count) signed domains. When they enable inbound DANE, these (likely more by then) will be protected by DNSSEC and DANE. The rear-view mirror is not always the best guide to the road ahead.

tptacek 7y ago
It looks like they're growing steadily, from those graphs, until you look at the Y axis and realize it's been cropped to look like it's growing steadily. In fact, in DNSSEC-signed zones in .COM have gone down in some recent years. In fact, DNSSEC is deployed in a tiny fraction of all .COM zones (something close to 1%), virtually none of which are significant, as you can quickly discover by feeding a list of top zones (the Moz 500 is easy to download) through "host -t ds". In reality, DNSSEC is moribund.