[dns-operations] August 2018 DNSSEC stats
Viktor Dukhovni
ietf-dane at dukhovni.org
Fri Aug 31 18:53:31 UTC 2018
[ With credit due to Paul Vixie of Farsight Security for supporting
this survey with ongoing data snapshots that help to significantly
improve the survey's coverage. Also of course ICANN for the gTLD
data via CZDS and data contributions from the TLD registries for
.CH, .DK, .INFO, .LI, .NL and .ORG and open access for .FR, .NU and
.SE. More data sources of ccTLD signed delegations welcome. ]
The August 2018 numbers from the DANE/DNSSEC survey are:
Total DS RRsets: 8,797,656
Validatable apex DNSKEY RRsets: 8,659,371
DNSKEY parameter frequency (1000 or more instances), by zone count:
kskalgs | flags | proto | alg
--------+-------+-------+-----
4818 | 257 | 3 | 3
355404 | 257 | 3 | 5
2204545 | 257 | 3 | 7
4146196 | 257 | 3 | 8
83827 | 257 | 3 | 10
1801364 | 257 | 3 | 13
62784 | 257 | 3 | 14
zskalgs | flags | proto | alg
--------+-------+-------+-----
4818 | 256 | 3 | 3
134228 | 256 | 3 | 5
2195083 | 256 | 3 | 7
4085477 | 256 | 3 | 8
83610 | 256 | 3 | 10
787345 | 256 | 3 | 13
61845 | 256 | 3 | 14
RSA key size distribution (1000 or more instances), by zone count:
kskdomains | bits
-----------+------
67539 | 4096
5088186 | 2048
301303 | 1536
2845 | 1280
1331013 | 1024
8555 | 512
zskdomains | bits
-----------+------
13227 | 4096
100021 | 2048
305870 | 1280
6070494 | 1024
8673 | 512
RSA exponent distribution:
domains | exponent
--------+--------------
6851200 | \x010001
13166 | \x0100000001
439 | \x03
50 | \xff39 (65337 typo)
34 | \x40000003
20 | \xffff (65535 poor choice)
Secure delegations found by TLD where > 999, ordered by decreasing
numer of domains (incomplete where authoritative data is not
available):
TLD total-DS
-------------+-----------
nl | 3026088
com | 922644
se | 817268
cz | 597215
eu | 501280
br | 490103
pl | 466281
fr | 414360
no | 376913
be | 144467
nu | 130024
net | 128944
hu | 119023
org | 96547
de | 84668
ch | 49449
info | 37532
app | 33897
uk | 32141
dk | 23295
ovh | 22462
biz | 19288
mx | 16689
es | 15947
io | 13171
pt | 12712
hk | 11935
me | 9010
xyz | 6958
shop | 6921
online | 6897
us | 6777
at | 5877
co | 5232
amsterdam | 4664
frl | 3899
kr | 3636
re | 3622
lv | 3583
tech | 3462
tv | 3005
fi | 2981
cloud | 2953
paris | 2873
bank | 2711
nrw | 2505
ru | 2413
in | 2357
store | 2316
ca | 2104
email | 1846
club | 1796
immo | 1747
art | 1607
world | 1596
bzh | 1483
ee | 1416
xn--j6w193g | 1248
space | 1210
au | 1204
is | 1200
gov | 1158
site | 1133
cc | 1102
mobi | 1074
agency | 1048
DNSKEY lookup failure rates (whether bogus, or just lame
delegation, ...) by TLD with 1000 or more signed delegations,
ordered by increasing failure rate:
TLD failed-DS total-DS %fail
-------------+----------+-----------+------
xn--j6w193g | 0 | 1248 | 0.00
br | 248 | 490103 | 0.05
hk | 10 | 11935 | 0.08
app | 39 | 33897 | 0.12
mx | 34 | 16689 | 0.20
re | 8 | 3622 | 0.22
art | 4 | 1607 | 0.25
ovh | 65 | 22462 | 0.29
immo | 7 | 1747 | 0.40
bzh | 8 | 1483 | 0.54
no | 2037 | 376913 | 0.54
shop | 39 | 6921 | 0.56
de | 480 | 84668 | 0.57
paris | 17 | 2873 | 0.59
nl | 18307 | 3026088 | 0.60
world | 11 | 1596 | 0.69
ee | 11 | 1416 | 0.78
fr | 3582 | 414360 | 0.86
eu | 4555 | 501280 | 0.91
agency | 10 | 1048 | 0.95
be | 1424 | 144467 | 0.99
is | 12 | 1200 | 1.00
hu | 1221 | 119023 | 1.03
cz | 6336 | 597215 | 1.06
ch | 528 | 49449 | 1.07
tv | 36 | 3005 | 1.20
fi | 36 | 2981 | 1.21
biz | 247 | 19288 | 1.28
pl | 6361 | 466281 | 1.36
tech | 47 | 3462 | 1.36
online | 98 | 6897 | 1.42
info | 539 | 37532 | 1.44
gov | 18 | 1158 | 1.55
org | 1510 | 96547 | 1.56
mobi | 17 | 1074 | 1.58
cloud | 47 | 2953 | 1.59
pt | 205 | 12712 | 1.61
store | 43 | 2316 | 1.86
kr | 68 | 3636 | 1.87
cc | 21 | 1102 | 1.91
me | 174 | 9010 | 1.93
net | 2598 | 128944 | 2.01
io | 270 | 13171 | 2.05
dk | 505 | 23295 | 2.17
us | 155 | 6777 | 2.29
com | 22369 | 922644 | 2.42
at | 147 | 5877 | 2.50
club | 47 | 1796 | 2.62
email | 52 | 1846 | 2.82
amsterdam | 139 | 4664 | 2.98
space | 38 | 1210 | 3.14
uk | 1018 | 32141 | 3.17
es | 547 | 15947 | 3.43
ca | 75 | 2104 | 3.56
xyz | 252 | 6958 | 3.62
co | 205 | 5232 | 3.92
lv | 161 | 3583 | 4.49
frl | 209 | 3899 | 5.36
se | 46392 | 817268 | 5.68
au | 70 | 1204 | 5.81
site | 67 | 1133 | 5.91
in | 169 | 2357 | 7.17
nu | 10151 | 130024 | 7.81
nrw | 288 | 2505 | 11.50
ru | 326 | 2413 | 13.51
bank | 1141 | 2711 | 42.09
--
Viktor.
More information about the dns-operations
mailing list