Defaults.Exposed › Stats › DNS & infrastructure
What percent of domains use DNSSEC?
October 2026 census edition
As of October 12, 2026, only 7.0% of the 332 million domains graded in the Defaults.Exposed census have a valid DNSSEC (Domain Name System Security Extensions) chain, 23,390,098 domains. A further 0.1% are signed but broken.
DNSSEC adoption: how it is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
A valid chain requires both a signed zone and a matching DS (Delegation Signer) record published at the registrar, and those are usually two different interfaces at two different companies. Counting only fully validating chains is stricter than counting signed zones, and it is the only measure that corresponds to protection a resolver can actually verify.
The denominator under that share is 332 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when operators sign zones, publish issuance restrictions, or change delegation. A large DNS (Domain Name System) provider can shift a percentage point on its own by changing one default for every customer at once. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your DNS records.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Result | Domains | Share |
|---|---|---|
| Signed, valid chain | 23,390,098 | 7.0% |
| Signed but broken | 265,080 | 0.1% |
| Unsigned | 308,837,141 | 92.9% |
DNSSEC adoption: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of domains use DNSSEC?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-domains-use-dnssec
Permalink: https://defaults.exposed/stats/what-percent-of-domains-use-dnssec · Machine-readable: /stats/s/dnssec-adoption.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.