M7: DNSSEC Deployment

2025/01

We track the deployment of DNSSEC by tracking four metrics:

The following table provides the value observed for the metrics in the current month, as well as the average value over the 3 previous months, and the "historical" minimum and maximum observed since the beginning of the measurements.

As of Jan 2025 Past 3 months Historic Low Historic High
M7.1: % of TLDs signed with DNSSEC (?) 92.94% 92.94% 90.47% 92.95%
M7.2: % of CC TLDs signed with DNSSEC (?) 65.32% 65.32% 50.40% 65.32%

M7.1: % of TLDs signed with DNSSEC

The following graph shows the evolution of the DNSSEC metric M7.1 (?) over time.

No M7.1 data available

M7.2: % of CC TLDs signed with DNSSEC

The following graph shows the evolution of the DNSSEC metric M7.2 (?) over time.

No M7.2 data available

M7.3: % of TLD using specific algorithms

Algorithms use by all TLDs As of Jan 2025Past 3 monthsHistoric LowHistoric High
RSA/SHA-256(8)80.484%80.484%75.332%82.421%
ECDSA Curve P-256 with SHA-256(13)9.412%9.389%2.387%9.412%
RSA/SHA-512(10)2.215%2.215%2.152%2.221%
RSASHA1-NSEC3-SHA1(7)0.623%0.646%0.623%9.284%
RSA/SHA-1(5)0.138%0.138%0.138%1.952%
ECDSA Curve P-384 with SHA-384(14)0.069%0.069%0.067%0.069%
Delete DS()0.000%0.000%0.000%0.000%

M7.4: % of CC TLD using specific algorithms

Algorithms use by CC TLDs As of Jan 2025Past 3 monthsHistoric LowHistoric High
RSA/SHA-256(8)45.161%45.161%40.323%45.161%
ECDSA Curve P-256 with SHA-256(13)17.339%17.339%6.855%17.339%
RSA/SHA-512(10)1.210%1.210%1.210%1.613%
RSASHA1-NSEC3-SHA1(7)0.806%0.807%0.806%4.436%
RSA/SHA-1(5)0.403%0.403%0.403%1.613%
ECDSA Curve P-384 with SHA-384(14)0.403%0.403%0.403%0.403%
Delete DS()0.000%0.000%0.000%0.000%