<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;
mso-contextual-alternates:no;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal style='text-align:justify'><a href="http://www.circleid.com/posts/20170109_report_on_state_of_dnssec_deployment_2016_continued_growth/">http://www.circleid.com/posts/20170109_report_on_state_of_dnssec_deployment_2016_continued_growth/</a><o:p></o:p></p><div style='border:none;border-bottom:solid windowtext 1.5pt;padding:0in 0in 1.0pt 0in'><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p></div><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>Did you know that over 50% of .CZ domains are now signed with DNS Security Extensions (DNSSEC)? Or that over <i>2.5 million</i> .NL domains and almost 1 million .BR domains are now DNSSEC-signed? Were you aware that around 80% of DNS clients are now requesting DNSSEC signatures in their DNS queries? And did you know that over 100,000 email domains are using DNSSEC and DANE to enable secure email between servers?<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>These facts and many more are available in a new report published by the Internet Society: <b><a href="https://www.internetsociety.org/doc/state-dnssec-deployment-2016">State of DNSSEC Deployment 2016</a></b><o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>While <a href="http://www.internetsociety.org/deploy360/dnssec/statistics/">many separate sites provide DNSSEC statistics</a>, this report collects the information into a series of tables and charts that paint an overall picture of the state of DNSSEC deployment as of December 2016.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>As the report indicates, there has been steady and strong growth in both the statistics around DNSSEC signing and validation — and also in the number of tools and libraries available to support DNSSEC. It also discusses the growth of DANE usage (DNS-based Authentication of Named Entities), particularly for securing email communication.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>That growth, though, is not evenly distributed.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>In some parts of the world, particularly in Europe, there is solid growth in both DNSSEC signing and validation. In other parts of the world, the numbers are significantly lower.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>Similarly, while some country-code top-level-domains (ccTLDs) such as .CZ, .SE, .NL and .BR are seeing high levels of DNSSEC signing of second-level domains, other ccTLDs are just beginning to see DNSSEC-signed domains. And among the other TLDs, some such as .GOV have almost 90% of their second-level domains signed, while .COM has under 1% signed.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>The report dives into all this and more. Beyond statistics, the document explores some of the current challenges to deployment of DNSSEC and provides a case study. It also includes many links to further resources for more exploration. Creating a report of this level involves a great number of people. I'd like to thank all the members of the DNS / DNSSEC community who provided data, reviews, proofreading and other support.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>Our intent is that this will be an annual report where we can look back and see what has changed year-over-year. Our target now is for the 2017 report to be delivered at the DNSSEC Workshop at ICANN 100 in November. To that end, I would definitely welcome any comments people have about what is in the report and what people find useful and helpful. I'd also welcome comments about anything we may have missed. <br>Please do <a href="https://www.internetsociety.org/doc/state-dnssec-deployment-2016">read and share this report widely</a>. We'd like people to understand the current state of DNSSEC deployment — and how we can work together to accelerate that progress. On that note, if you want to get started with DNSSEC for your own network or domains, <a href="http://www.internetsociety.org/deploy360/start/">many resources are available to help</a>.<o:p></o:p></p><p class=MsoNormal style='text-align:justify'><o:p> </o:p></p><p class=MsoNormal style='text-align:justify'>P.S. an <a href="https://soundcloud.com/danyork/tdyr-320-the-state-of-dnssec">audio commentary is also available</a> on this topic for those interested in listening to me talk about this topic.<o:p></o:p></p></div></body></html>