Subject: [DNSOP] CDS/CDNSKEY Deployment

From: Eric Rescorla <[email-masked]>
Date: Wed, 12 Jan 2022 19:12:45 -0800

Hi folks

Does anyone have stats on the deployment of CDS and/or CDNSKEY? I see that
Chung et al. report very low deployment in 2017, but maybe things have
changed?

-Ekr

---

From: Daniel Stirnimann <[email-masked]>
Date: Thu, 13 Jan 2022 14:11:59 +0100

Hi Eric,

Some statistics for .ch/.li which are some of the few TLDs supporting
CDS/CDNSKEY [1].

For 2020 we processed:

189'206  BOOTSTRAP
518      DELETE
44'749   ROLLOVER

Slide 3 [2] contains some more historical numbers. Context about the
number of signed delegations in .ch [3].

Daniel

[1] https://github.com/oskar456/cds-updates/
[2] https://68.schedule.icann.org/meetings/EqJCzT5N6kcZhh2TT
[3] https://www.nic.ch/statistics/dnssec/

On 13.01.22 04:12, Eric Rescorla wrote:
> Hi folks
> 
> Does anyone have stats on the deployment of CDS and/or CDNSKEY? I see
> that Chung et al. report very low deployment in 2017, but maybe things
> have changed?
>

---

From: Daniel Stirnimann <[email-masked]>
Date: Thu, 13 Jan 2022 14:14:40 +0100

I meant to say "For 2021 we processed".

Still need to get used to typing the new year :-)

Daniel

---

From: Moritz Müller <[email-masked]>
Date: Fri, 14 Jan 2022 08:00:32 +0100

I’ve supervised an undergraduate student last year, who looked a bit into CDS Deployment [1].
Though he mostly analysed .ch data as well.

Moritz

[1] http://essay.utwente.nl/86832/1/van%20Beijnum_BA_EEMCS.pdf

> On 13 Jan 2022, at 14:14, Daniel Stirnimann <[email-masked]> wrote:
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Mark Elkins <[email-masked]>
Date: Fri, 14 Jan 2022 09:36:26 +0200

Hi,

I run/manage the EDU.ZA zone and am a Registrar.
Both systems poll for CDS records.... if I'm not running the DNS for the 
domain (e.g. many of the Registrar domains). I have also given 
presentations on this at the ICANN DNSSEC & Security Workshop - which I 
also assist with.

I poll once a day in the small hours of the night. The systems work 
fine. Job done?

I am though curious as to what Statistics people gather (what people 
thing would be useful). I do have log files of events - so could pick up 
various stats over time?

EDU.ZA (a "restricted" zone) CDS/DNSSEC numbers are not big but the zone 
only has about 150 delegations.
Registrar numbers are better but I also offer DNSSEC "instant 
gratification" via a web interface - which my Registrants (& resellers) 
prefer - rather than waiting a few days for the CDS polling to believe 
what it finds.

The system has been great though at picking up Domains hosted with 
Cloudflare - who offer DNSSEC Signing of a domain with a click of a 
button. Not sure if there are other companies on the scale and 
functionality of Cloudflare?

-- 

Mark James ELKINS  -  Posix Systems - (South) Africa
[email-masked]       Tel: +27.826010496 <tel:+27826010496>
For fast, reliable, low cost Internet in ZA: https://ftth.posix.co.za 
<https://ftth.posix.co.za>

Posix SystemsVCARD for MJ Elkins

---

From: Nils Wisiol <[email-masked]>
Date: Fri, 14 Jan 2022 11:00:52 +0100

At desec.io, we automatically sign and deploy CDS/CDNSKEY records for
all zones. Still, of all zones delegated to our name servers, only 53%
are securely delegated. This breaks down into 94% securely delegated
for TLDs that use CDS/CDNSKEY bootstrapping (AFAIK, .ch, .cr, .cz, .li,
.nu, .se, .sk) and 52% for other TLDs.

(Above statistics do not include zones from our own public suffix
dedyn.io, which are automatically securely delegated. Also, some rare
edge cases may not be properly counted.)

Best,
Nils

-- 
deSEC e.V. · Kyffhäuserstr. 5 · 10781 Berlin · Germany

Vorstandsvorsitz: Nils Wisiol
Registergericht: AG Berlin (Charlottenburg) VR 37525