Defaults.Exposed › November 2026 census › v10 registry › DNSSEC
DNSSEC
Methodology v10 · canonical ID dnssec · DNS (Domain Name System) Security · scored
Stops attackers hijacking your domain to send visitors to a fake copy of your site.
DNSSEC: definition
| Canonical ID | dnssec |
|---|---|
| Category | DNS Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The chain of trust validates end to end: a DS (Delegation Signer) record at the parent zone anchors it, and the zone publishes DNSKEY (DNS Public Key) records that validate against that DS record. The census scores the chain as one check, because a chain that is broken at either end provides no protection at all. |
| Fail | No DS record exists, so the zone is unsigned from the parent’s point of view; or DNSKEY is missing or does not validate against the DS record, which is the signed-but-broken state. A validating resolver rejects the answer in the second case, which is worse for visitors than being unsigned. |
| Example (passing) | example.com. IN DS 12345 13 2 A1B2C3…
example.com. IN DNSKEY 257 3 13 mdsswUyr… |
DNSSEC across the census
7.12% of graded domains have a valid, fully validating DNSSEC (Domain Name System Security Extensions) chain (23,854,462 of 334,831,177, as of November 2, 2026).
Scored as a single signed-and-validating measure rather than split into DS and DNSKEY. A further share of domains are signed but broken.
Aggregates only: never an individual domain's result.
How this check is scored
DNSSEC is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the November 2026 census, every graded domain had a determinable result for this check.
Every outcome in the census
| Outcome | Domains | Share of graded domains | In the headline figure |
|---|---|---|---|
| Signed, chain validates | 23,854,462 | 7.12% | Yes |
| Signed, chain does not validate | 148,976 | 0.04% | No |
| Unsigned | 310,827,739 | 92.8% | No |
Source: the November 2026 census rollup, deduplicated per domain, as of November 2, 2026.
By top-level domain
This splits the share of graded domains that have a valid, fully validating DNSSEC chain by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 355 TLDs, 236,412,165 domains | 5.45% | .beer 30.6%, .garden 22.2%, .one 17.3% | .vip 1.12%, .help 1.27%, .bet 1.37% |
| Country-code TLDs (ccTLDs): 171 TLDs, 97,724,875 domains | 11.2% | .dk 69.6%, .cz 64.9%, .se 61.9% | .ae 0.00%, .gq 0.00%, .cf 0.00% |
The largest TLD in this base, .com, stands at 5.43% (8,421,482 of 155,186,800).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 334,137,040 of the 334,831,177 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 4 DNS Security checks with a published figure, DNSSEC has the 3rd highest pass share. Next above it is Nameserver diversity: 99.0% of domains whose nameserver delegation could be enumerated. Next below it is CAA (Certification Authority Authorization) records: 1.82% of domains where the CAA lookup returned a determinate answer. Across every check with a published figure it ranks 22nd of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix DNSSEC
DNSSEC setup walkthroughs for 1 providers: REG.RU. All of them are on the DNSSEC setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "DNSSEC (dnssec)", Grading Methodology v10 (census as of November 2, 2026). https://defaults.exposed/methodology/dnssec
Permalink: https://defaults.exposed/methodology/dnssec ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data