<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 1 May 2018, at 19:23, Viktor Dukhovni <<a href="mailto:ietf-dane@dukhovni.org" class="">ietf-dane@dukhovni.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class=""><br class=""><blockquote type="cite" class="">On May 1, 2018, at 5:29 PM, Rubens Kuhl <<a href="mailto:rubensk@nic.br" class="">rubensk@nic.br</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">It is interesting that even with the looming GDPR, France is able to<br class="">provide 30-day-old data for unrestricted download and .SE provides<br class="">fresh data, while others are unable to provide either fresh or stale<br class="">data. There are perhaps contractual constraints with existing<br class="">registrants, and/or country-specific laws...<br class=""></blockquote><br class="">Or concerns with WHOIS harvesting.<br class=""></blockquote><br class="">If that were my only concern, I'd focus on rate-limiting WHOIS,<br class=""></div></div></blockquote><div><br class=""></div><div><br class=""></div>Why do you think rate-litmiting WHOIS isn't also done ? At least in .br, it is. </div><div><br class=""><blockquote type="cite" class=""><div class=""><div class="">and still admit reasonable requests for zone file access when<br class="">presented with evidence of a legitimate use-case. I am guessing<br class="">there are more reasons than just that... :-(<br class=""><br class=""></div></div></blockquote><div><br class=""></div><div>Nope, just that, and the willingness to put registrant interests ahead of possible research interests. </div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="">Overall I have 1,173,206 .br domain names of which 239,412 or<br class="">20.4% return a validated answer (perhaps NODATA) for MX lookups.<br class=""></div></div></blockquote><div><br class=""></div>Couldn't some domains be using A or AAAA instead of MX ? It's old school but still works. </div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">Frederico reports 1,044,645/3,959,979 or 26.3% DNSSEC/TOTAL, so my<br class="">present dataset appears to under-sample the signed domains. The<br class="">relevant suffixes are mostly:<br class=""><br class="">1079739 .<a href="http://com.br" class="">com.br</a><br class=""> 21925 .<a href="http://org.br" class="">org.br</a><br class=""> 16640 .<a href="http://ba.gov.br" class="">ba.gov.br</a><br class=""></div></div></blockquote><div><br class=""></div>.<a href="http://xx.gov.br" class="">xx.gov.br</a> are state-level governmental domains, run by a state-level governmental organisation. So each of them might provide you a zone file or not at their discretion, and each of them might DNSSEC-signed or not at their discretion. </div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""> 13413 .<a href="http://blogspot.com.br" class="">blogspot.com.br</a><br class=""></div></div></blockquote><div><br class=""></div><a href="http://blogspot.com.br" class="">blogspot.com.br</a> is a domain. Any entry there is a hostname in the domain, and since it's owned by Google Blogger service, unlike to have mail service. </div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""> 9533 .<a href="http://net.br" class="">net.br</a><br class=""></div></div></blockquote><div><br class=""></div>Most of .<a href="http://com.br" class="">com.br</a>, .<a href="http://org.br" class="">org.br</a> and .<a href="http://net.br" class="">net.br</a> domains that also happen to have mail service appear at Cisco Umbrella's 1M list, more than at Alexa's 1M list that looks more browser oriented. </div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""> 3663 .<a href="http://adv.br" class="">adv.br</a><br class=""> 3063 .<a href="http://ind.br" class="">ind.br</a><br class=""> 1544 .<a href="http://art.br" class="">art.br</a><br class=""> 1449 .<a href="http://inf.br" class="">inf.br</a><br class=""> 1409 .<a href="http://edu.br" class="">edu.br</a><br class=""> 1188 .<a href="http://eng.br" class="">eng.br</a><br class=""> 1162 .br</div></div></blockquote><br class=""></div><div>Have you tried DNSSECWalk with those smaller zones ? I remember com/org/net .br being the ones with NSEC3 and the others having NSEC, but I couldn't confirm it now. </div><div><br class=""></div><div><br class=""></div><div><br class=""></div><div>Rubens</div><div><br class=""></div><div><br class=""></div></body></html>