Only 0.0%
of the internet is
cryptographically secured
We analyzed 0 domains. Only 0 use DNSSEC.
gTLD zone file analysis•December 2025•905 TLDs covered
Explore the DataThe Scale of the Problem
DNSSEC protects DNS queries from tampering. Yet only a tiny fraction of domains have it enabled.
Among DNSSEC-signed domains in gTLD zone files. Country-code TLDs (.uk, .de, .jp) not included.
“The largest DNSSEC analysis ever conducted reveals that the vast majority of the internet remains vulnerable to DNS cache poisoning and man-in-the-middle attacks.”
8% Growth in 2025
DNSSEC adoption is accelerating. Emerging markets and developer-focused TLDs are leading the charge.
Comparing December 2025 vs December 2024 snapshots from gTLD zone file analysis
Fastest Growing Countries
By DNSSEC-signed domain count growth
Fastest Growing TLDs
By DNSSEC-signed domain count growth
2025 Year in Review
DNSSEC adoption grew by 7.6% year-over-year, with emerging markets leading the charge. The shift to modern ECDSA algorithms accelerated, now representing 40.3% of all signed domains.
The Geography of Security
DNSSEC adoption varies dramatically by region. Infrastructure concentration creates single points of failure.
Country attribution based on DNS infrastructure geolocation, not organization headquarters.
Top Countries
Top ISPs
TLDs & Registrars
Domain extensions and registrars play a crucial role in DNSSEC adoption. Some registrars make it easy, others don't.
Top TLDs (Domain Extensions)
905 total TLDs in our dataset
Domain counts among DNSSEC-signed domains only
Top Domain Registrars
6593 unique registrars with DNSSEC domains
Registrar data from WHOIS records of signed domains
Registrar Impact on DNSSEC Adoption
Domain registrars have significant influence over DNSSEC adoption. Registrars that make DNSSEC easy to enable see higher adoption rates. Some automatically enable DNSSEC by default, while others require manual configuration.
A Handful of Providers
Control the Keys
The top autonomous systems host a disproportionate share of DNSSEC infrastructure.
ASN data identifies networks hosting DNS nameservers for DNSSEC-signed domains.
google llc
AS15169
domains
41.2%cloudflare inc
AS13335
domains
23.5%ovh sas
AS16276
domains
9.4%Concentration Risk
High concentration in a few providers creates systemic risk. Any outage or compromise at these providers would have outsized impact on global DNS security.
The Algorithm Landscape
DNSSEC supports multiple cryptographic algorithms. Modern elliptic curve algorithms offer better security and performance.
Distribution of cryptographic algorithms among DNSSEC-signed domains
Algorithm Reference
Most Popular Sites Are 2.7x More Secure
The world's most popular websites adopt DNSSEC at nearly three times the global rate. Security correlates with organizational maturity.
14.3% of Top 1M sites use gTLDs. Many top sites use ccTLDs (.uk, .de, .ru) not in this analysis.
Why the difference?
High-traffic websites have stronger security teams, compliance requirements, and more to lose from DNS attacks. The gap shows that DNSSEC adoption correlates with organizational security maturity.
Top TLDs by Adoption (in Top 1M)
DNSSEC adoption rates among gTLD domains appearing in the Tranco Top 1M list
From 100% to 0%
Some TLDs mandate DNSSEC by policy. Others have completely ignored it. The contrast is striking.
100% Secured
TLDs with perfect adoption
Why? These are regulated industry TLDs where DNSSEC is mandated by registry policy. Financial services lead the way.
0% Secured
Large TLDs with zero adoption
Surprising: Major brand TLDs like .toyota and .canon have zero DNSSEC adoption despite owning their entire namespace.
Is Your Domain Secured?
Check any domain in real-time to see if DNSSEC is enabled and which algorithms are used.