Mal ein paar DNSSec Statistiken

#1 (**permalink**) 05-07-2007, 03:27 PM

Overview of 1449 signed zones:
1098 +5 Entry Point
7 broken chain
222 +27 chained
122 +85 unreachable

Top 10 autonomous systems injecting DNSSec zones:
440 -1 AS15725
387 AS3265
70 AS3333
69 AS3557
45 +45 AS16350
32 AS25537
32 AS3245
27 AS24776
23 +23 AS39570
17 AS36810

Top 10 TLD containing DNSSec zones:
359 +59 NL
242 ARPA
219 +1 DE
213 +8 COM
70 +38 SE
64 +2 ORG
54 +2 NET
33 BG
33 RU
26 INFO

577 (+9) weak keys:
Top 10 autonomous systems injecting weak keys:
360 AS3265
31 -1 AS25537
27 AS24776
13 AS3216
12 AS29632
10 -1 AS7132
7 AS20943
6 AS8228
5 -1 AS23342
5 AS8683

7 broken DS chains:
42.32.198.in-addr.arpa, badds.dnssec.jp, hostcount.ripe.net, k.ripe.net
ris.ripe.net, jelte.nlnetlabs.nl, bitstring.se

12 parent DS to unsigned zones:
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 131.111.89.in-addr.arpa
132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa
135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa
138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa

24 (+7) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
241.75.217.in-addr.arpa, 3.1.6.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, amstel.bg, badnxt.dnssec.jp
nods-ns.test.dnssec-tools.org, autonomica.se, bildframkallning.se, cafax.se
echo-lan.se, fotoaffisch.se, fotopresent.se, fotoprints.se, hooden.se
kortframkallning.se, nning.se, onlinefoto.se, pixaco.se, shinkuro.se
skabb.se, staver.se, zkt.se

122 unreachable zones:
Top 10 autonomous systems containing unreachable zones:
45 AS16350
4 AS10370
4 AS5537
2 AS7132
2 AS9150
2 AS40009
2 AS3561
1 AS39003
1 AS12996
1 AS31680

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#2 (**permalink**) 05-14-2007, 03:00 PM

[ The amount of zones and the state of the zones stabilizes slowly.
I'll drop the posting frequency accordingly. -- lutz ]
[ Mit zunehmender Beruhigung der Statistik wird seltener gepostet. -- lutz ]

Overview of 1459 signed zones:
1084 -14 Entry Point
8 +1 broken chain
237 +15 chained
130 +8 unreachable

Top 10 autonomous systems injecting DNSSec zones:
440 AS15725
386 -1 AS3265
70 AS3333
69 AS3557
45 AS16350
43 +11 AS3245
31 -1 AS25537
27 AS24776
23 AS39570
17 AS36810

Top 10 TLD containing DNSSec zones:
359 NL
242 ARPA
219 DE
212 -1 COM
70 SE
64 ORG
54 NET
44 +11 BG
33 RU
26 INFO

568 (-9) weak keys:
Top 10 autonomous systems injecting weak keys:
354 -6 AS3265
31 AS25537
27 AS24776
13 AS3216
12 AS29632
10 AS7132
7 AS20943
6 AS8228
5 AS23342
5 AS8683

8 (+1) broken DS chains:
42.32.198.in-addr.arpa, wesh.netsec.tislabs.com, badds.dnssec.jp
hostcount.ripe.net, k.ripe.net, ris.ripe.net, jelte.nlnetlabs.nl
bitstring.se

14 (+2) parent DS to unsigned zones:
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 131.111.89.in-addr.arpa
132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa
135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa
138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa
mike.netsec.tislabs.com, ldap.trstech.net

17 (-7) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
241.75.217.in-addr.arpa, 3.1.6.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, amstel.bg, badnxt.dnssec.jp
nods-ns.test.dnssec-tools.org, autonomica.se, cafax.se, echo-lan.se
hooden.se, nning.se, shinkuro.se, skabb.se, staver.se, zkt.se

130 (+8) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
45 AS16350
5 +5 AS3265
4 AS10370
4 AS5537
2 AS7132
2 AS9150
2 AS40009
2 +1 AS20857
2 AS3561
1 AS39003

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#3 (**permalink**) 05-29-2007, 08:11 AM

Overview of 1480 signed zones:
714 -370 Entry Point
11 +3 broken chain
235 -2 chained
26 +20 new
494 +364 unreachable

Top 10 autonomous systems injecting DNSSec zones:
440 AS15725
387 +1 AS3265
70 AS3333
69 +26 AS3245
68 -1 AS3557
45 AS16350
31 AS25537
27 AS24776
23 AS39570
17 AS36810

Top 10 TLD containing DNSSec zones:
356 -3 NL
241 -1 ARPA
220 +1 DE
212 COM
70 SE
70 +26 BG
64 ORG
53 -1 NET
32 -1 RU
26 INFO

223 (-345) weak keys:
Top 10 autonomous systems injecting weak keys:
31 AS25537
27 AS24776
13 AS3216
12 +2 AS7132
12 AS29632
7 AS20943
7 -347 AS3265
5 -1 AS8228
5 AS8683
4 AS546

11 (+3) broken DS chains:
17.32.198.in-addr.arpa, 42.32.198.in-addr.arpa, wesh.netsec.tislabs.com
badds.dnssec.jp, hostcount.ripe.net, k.ripe.net, ris.ripe.net
jelte.nlnetlabs.nl, bitstring.se, xn--ihrn-dpa.se
xn--lda-ula.xn--ihrn-dpa.se

23 (+9) parent DS to unsigned zones:
228.111.193.in-addr.arpa, 98.227.193.in-addr.arpa, 128.111.89.in-addr.arpa
129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa
132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa
135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa
138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa
demo.netsec.tislabs.com, isles.netsec.tislabs.com, lindy.netsec.tislabs.com
mike.netsec.tislabs.com, orange.dnssec.jp, segdns.test.mx, ldap.trstech.net
a.smallzone.uk-dnssec.nic.uk

16 (-1) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
241.75.217.in-addr.arpa, 3.1.6.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, badnxt.dnssec.jp
nods-ns.test.dnssec-tools.org, autonomica.se, cafax.se, echo-lan.se
hooden.se, nning.se, shinkuro.se, skabb.se, staver.se, zkt.se

494 (+364) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
380 +375 AS3265
45 AS16350
4 AS5537
2 -2 AS10370
2 AS9150
2 AS20857
2 AS3561
1 AS39003
1 AS12996
1 AS31680

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#4 (**permalink**) 05-29-2007, 08:15 AM

> Overview of 1480 signed zones:
> 714 -370 Entry Point
> 494 +364 unreachable
>
> Top 10 autonomous systems containing unreachable zones:
> 380 +375 AS3265

AS3265 did change their nameserver software. The new one is unable to serve
DNSSEC at the moment. They promise a fix.

> Overview of 1480 signed zones:
> 26 +20 new
>
> Top 10 TLD containing DNSSec zones:
> 70 +26 BG

Bulgaria introduced the twenty six new SLDs [a-z].bg and a signed domain is
registred by all these new SLDs, too.

#5 (**permalink**) 06-11-2007, 08:42 AM

Overview of 1419 signed zones:
709 -5 Entry Point
10 -1 broken chain
279 +44 chained
0 -26 new
421 -73 unreachable

Top 10 autonomous systems injecting DNSSec zones:
440 AS15725
385 -2 AS3265
70 AS3333
69 AS3245
68 AS3557
30 -1 AS25537
27 AS24776
23 AS39570
19 +19 AS22548
17 AS36810

Top 10 TLD containing DNSSec zones:
296 -60 NL
241 ARPA
219 -1 DE
204 -8 COM
70 SE
70 BG
62 -2 ORG
51 -2 NET
31 -1 RU
26 INFO

212 (-11) weak keys:
Top 10 autonomous systems injecting weak keys:
30 -1 AS25537
26 -1 AS24776
13 AS3216
12 AS7132
12 AS29632
7 AS20943
7 AS3265
5 AS8228
5 AS8683
4 AS546

10 (-1) broken DS chains:
17.32.198.in-addr.arpa, 42.32.198.in-addr.arpa, wesh.netsec.tislabs.com
badds.dnssec.jp, hostcount.ripe.net, k.ripe.net, ris.ripe.net, bitstring.se
xn--ihrn-dpa.se, xn--lda-ula.xn--ihrn-dpa.se

28 (+5) parent DS to unsigned zones:
228.111.193.in-addr.arpa, 98.227.193.in-addr.arpa, 128.111.89.in-addr.arpa
129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa
132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa
135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa
138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa
demo.netsec.tislabs.com, isles.netsec.tislabs.com, lindy.netsec.tislabs.com
mike.netsec.tislabs.com, robert.wesh.netsec.tislabs.com, orange.dnssec.jp
segdns.test.mx, ldap.trstech.net, klan-csa.se, nl-dnssectest.se, umdac.se
webro.se, a.smallzone.uk-dnssec.nic.uk

17 (+1) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
241.75.217.in-addr.arpa, 3.1.6.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, pixaco.com.br, badnxt.dnssec.jp
nods-ns.test.dnssec-tools.org, autonomica.se, cafax.se, echo-lan.se
hooden.se, nning.se, shinkuro.se, skabb.se, staver.se, zkt.se

421 (-73) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
378 -2 AS3265
4 +2 AS10370
4 AS5537
1 +1 AS24776
1 +1 AS23342
1 +1 AS39570
1 +1 AS1273
1 +1 AS15083
1 +1 AS22548
1 +1 AS6245

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#6 (**permalink**) 06-11-2007, 08:44 AM

* Lutz Donnerhacke wrote:
> Overview of 1419 signed zones:
> 709 -5 Entry Point
> 10 -1 broken chain
> 279 +44 chained
> 0 -26 new
> 421 -73 unreachable

cc-TLD BR is signed now.

#7 (**permalink**) 08-01-2007, 03:12 PM

Overview of 1033 signed zones:
695 -14 Entry Point
10 broken chain
279 chained
0 new
49 -372 unreachable

Top 10 autonomous systems injecting DNSSec zones:
439 -1 AS15725
70 AS3333
69 AS3245
68 AS3557
29 -1 AS25537
26 -1 AS24776
23 AS39570
20 +1 AS22548
17 AS36810
17 AS10466

Top 10 TLD containing DNSSec zones:
242 +1 ARPA
217 -2 DE
145 -59 COM
70 SE
69 -1 BG
52 -10 ORG
44 -7 NET
29 -2 RU
22 +22 BR
21 -5 INFO

191 (-21) weak keys:
Top 10 autonomous systems injecting weak keys:
29 -1 AS25537
26 AS24776
13 AS3216
13 +1 AS29632
12 AS7132
7 AS20943
5 AS8228
5 AS8683
4 +4 AS12859
4 +4 AS6197

10 broken DS chains:
17.32.198.in-addr.arpa, 42.32.198.in-addr.arpa, wesh.netsec.tislabs.com
badds.dnssec.jp, hostcount.ripe.net, k.ripe.net, ris.ripe.net, bitstring.se
xn--ihrn-dpa.se, xn--lda-ula.xn--ihrn-dpa.se

31 (+3) parent DS to unsigned zones:
157.110.193.in-addr.arpa, 228.111.193.in-addr.arpa, 98.227.193.in-addr.arpa
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa
131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa
134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa
137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa
140.111.89.in-addr.arpa, demo.netsec.tislabs.com, isles.netsec.tislabs.com
lindy.netsec.tislabs.com, mike.netsec.tislabs.com
robert.wesh.netsec.tislabs.com, orange.dnssec.jp, segdns.test.mx
ldap.trstech.net, subsigned.signed.telin.nl, hogskolaniboras.se
klan-csa.se, kristianstadpower.se, nl-dnssectest.se, umdac.se, webro.se

15 (-2) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
241.75.217.in-addr.arpa, pixaco.com.br, badnxt.dnssec.jp
nods-ns.test.dnssec-tools.org, autonomica.se, cafax.se, echo-lan.se
hooden.se, nning.se, shinkuro.se, skabb.se, staver.se, zkt.se

49 (-372) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
12 +8 AS5537
8 -370 AS3265
4 +3 AS23342
2 +2 AS8608
2 +1 AS39570
1 +1 AS2833
1 +1 AS14744
1 +1 AS4436
1 +1 AS546
1 +1 AS40966

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#8 (**permalink**) 08-01-2007, 03:15 PM

* Lutz Donnerhacke wrote:
> Overview of 1033 signed zones:
> 49 -372 unreachable
>
> 49 (-372) unreachable zones:
> Top 10 autonomous systems containing unreachable zones:
> 8 -370 AS3265

AS3265 failed to upgrade their software for DNSSEC.

#9 (**permalink**) 08-31-2007, 10:48 AM

Overview of 11627 signed zones:
1499 +804 Entry Point
9618 +9618 Test
6 -4 broken chain
405 +126 chained
0 new
99 +50 unreachable

Top 10 autonomous systems injecting DNSSec zones:
783 +754 AS25537
461 +22 AS15725
125 +57 AS3557
77 +7 AS3333
70 +50 AS22548
69 AS3245
45 +19 AS24776
28 +5 AS39570
19 +5 AS559
18 +5 AS3216

Top 10 TLD containing DNSSec zones:
783 +754 RU
274 +32 ARPA
232 +15 DE
147 +2 COM
100 +48 ORG
88 +18 SE
84 +62 BR
69 BG
48 +4 NET
38 +38 FR

950 (+759) weak keys:
Top 10 autonomous systems injecting weak keys:
753 +724 AS25537
45 +19 AS24776
18 +5 AS3216
16 +11 AS8228
13 AS29632
9 -3 AS7132
8 +1 AS20943
4 +4 AS29344
4 AS12859
3 +3 AS2119

6 (-4) broken DS chains:
17.32.198.in-addr.arpa, 42.32.198.in-addr.arpa, iana.icann.root.zx.com
bitstring.se, xn--ihrn-dpa.se, xn--lda-ula.xn--ihrn-dpa.se

24 (-7) parent DS to unsigned zones:
157.110.193.in-addr.arpa, 228.111.193.in-addr.arpa, 98.227.193.in-addr.arpa
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa
131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa
134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa
137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa
140.111.89.in-addr.arpa, ldap.trstech.net, hogskolaniboras.se, klan-csa.se
kristianstadpower.se, nl-dnssectest.se, umdac.se, webro.se, xelerance.se

26 (+11) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa, 4.32.198.in-addr.arpa
178.25.217.in-addr.arpa, 241.75.217.in-addr.arpa
4.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 5.2.0.0.1.6.0.1.0.0.2.ip6.arpa
6.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.2.0.0.1.6.0.1.0.0.2.ip6.arpa
3.1.6.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa
1.0.0.0.e.4.7.c.3.6.8.d.2.0.0.2.ip6.arpa, pixaco.com.br, dlv.switch.ch
dnssec.switch.ch, sub.jelte.nlnetlabs.nl, ipv6.stack.nl, ddns.klubkev.org
autonomica.se, cafax.se, echo-lan.se, nning.se, shinkuro.se, skabb.se
staver.se, zkt.se

99 (+50) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
30 +29 AS25537
12 AS5537
7 +6 AS15725
4 +4 AS6197
4 +2 AS39570
2 -6 AS3265
1 +1 AS22894
1 +1 AS15201
1 AS2833
1 +1 AS80

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#10 (**permalink**) 08-31-2007, 10:59 AM

* Lutz Donnerhacke wrote:
> Overview of 11627 signed zones:
> 1499 +804 Entry Point
> 9618 +9618 Test
> 6 -4 broken chain
> 405 +126 chained
> 0 new
> 99 +50 unreachable

I seperated testing enviroments from real deployment.
Testing zones are not further examined.

> Top 10 TLD containing DNSSec zones:
> 783 +754 RU
> 274 +32 ARPA
> 232 +15 DE
> 147 +2 COM
> 100 +48 ORG
> 88 +18 SE
> 84 +62 BR
> 69 BG
> 48 +4 NET
> 38 +38 FR

I got some information from the RU and the FR zone, so I could check those
zone more deeply.

Futhermore I checked the immediate IP neighbourhood of servers in signed
zones for other hosts assuming that the zones of those hosts are also
signed. This reveals a lot of new entries.

Finally I send e-mail about configuration errors or possible improvments to
the zonemasters of possibly errornous zones. Several of those configurations
where fixed.

--
Public production ready DNSSEC signed root at a.dnssec.thur.de, ...
. DS 47484 5 1 83BD0576C2EB42FA9E9B5B9FDD8000F2E1F30C5B
Lookaside zone for most effective DNSSEC deployment right now.
dnssec.iks-jena.de. DS 61533 5 1 CEF158A447EF2E65ACBDBDC068231E08A991A269

#11 (**permalink**) 10-01-2007, 02:05 PM

Overview of 11616 signed zones:
1461 -38 Entry Point
9619 +1 Test
5 -1 broken chain
417 +12 chained
0 new
114 +15 unreachable

Top 10 autonomous systems injecting DNSSec zones:
767 -16 AS25537
457 -4 AS15725
125 AS3557
77 AS3333
72 +2 AS22548
70 +1 AS3245
45 AS24776
28 AS39570
19 +2 AS36810
19 AS559

Top 10 TLD containing DNSSec zones:
767 -16 RU
278 +4 ARPA
231 -1 DE
142 -5 COM
102 +2 ORG
91 +3 SE
89 +5 BR
69 BG
48 NET
38 FR

911 (-39) weak keys:
Top 10 autonomous systems injecting weak keys:
715 -38 AS25537
45 AS24776
18 AS3216
16 AS8228
13 AS29632
9 +1 AS20943
8 -1 AS7132
4 AS29344
3 AS2119
3 AS3215

5 (-1) broken DS chains:
17.32.198.in-addr.arpa, 42.32.198.in-addr.arpa, bitstring.se
xn--ihrn-dpa.se, xn--lda-ula.xn--ihrn-dpa.se

46 (+22) parent DS to unsigned zones:
0.20.149.in-addr.arpa, 20.20.149.in-addr.arpa, 64.20.149.in-addr.arpa
157.110.193.in-addr.arpa, 228.111.193.in-addr.arpa, 98.227.193.in-addr.arpa
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa
131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa
134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa
137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa
140.111.89.in-addr.arpa, niet.verweg.com, dnssec.test.kr, drone.test.kr
khj.test.kr, prove.test.kr, ldap.trstech.net, pdnssec.jelte.nlnetlabs.nl
sub.sub.jelte.nlnetlabs.nl, backgammon.brixtal.se, cycled.brixtal.se
decay.brixtal.se, mods.brixtal.se, nyetworks.brixtal.se, spiffy.brixtal.se
swabbing.brixtal.se, tooled.brixtal.se, zenning.brixtal.se, zero.brixtal.se
hogskolaniboras.se, klan-csa.se, kristianstadpower.se, lyrek.se
nl-dnssectest.se, tshirttryck.se, umdac.se, webro.se, xelerance.se

29 (+3) unnecessary islands:
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa
146.32.198.in-addr.arpa, 178.32.198.in-addr.arpa, 4.32.198.in-addr.arpa
178.25.217.in-addr.arpa, 241.75.217.in-addr.arpa
4.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 5.2.0.0.1.6.0.1.0.0.2.ip6.arpa
6.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, pixaco.com.br, eficacia.eng.br
conectway.net.br, sub.jelte.nlnetlabs.nl, ipv6.stack.nl, dyn.johani.org
ddns.klubkev.org, autonomica.se, cafax.se, echo-lan.se, gavle.se, nning.se
ockelbo.se, shinkuro.se, skabb.se, staver.se, zkt.se

114 (+15) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
52 +22 AS25537
12 AS5537
5 -2 AS15725
5 +1 AS39570
2 AS3265
1 AS2833
1 +1 AS13270
1 AS23342
1 +1 AS12322
1 +1 AS20712

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#12 (**permalink**) 12-07-2007, 09:12 AM

Overview of 11656 signed zones:
1496 +35 Entry Point
9618 -1 Test
5 broken chain
440 +23 chained
0 new
97 -17 unreachable

Top 10 autonomous systems injecting DNSSec zones:
733 -34 AS25537
456 -1 AS15725
128 +3 AS3557
81 +9 AS22548
78 +1 AS3333
72 +2 AS3245
45 AS24776
32 -353 AS3265
29 +1 AS39570
21 +2 AS36810

Top 10 TLD containing DNSSec zones:
733 -34 RU
285 +7 ARPA
233 +2 DE
159 +17 COM
122 +20 ORG
99 +10 BR
84 -7 SE
71 +2 BG
53 +5 NET
38 FR

871 (-40) weak keys:
Top 10 autonomous systems injecting weak keys:
689 -26 AS25537
45 AS24776
18 AS3216
15 -1 AS8228
9 -4 AS29632
8 -1 AS20943
4 AS29344
4 AS12859
3 AS2119
3 AS3215

5 broken DS chains:
228.111.193.in-addr.arpa, sparta.dnsops.biz, ornl.dnsops.gov, bitstring.se
tgfslp.dalmany.co.uk

31 (-15) parent DS to unsigned zones:
0.20.149.in-addr.arpa, 64.20.149.in-addr.arpa, 157.110.193.in-addr.arpa
178.170.195.in-addr.arpa, 128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa
130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa
133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa
136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa
139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa, dnssec.test.kr
drone.test.kr, khj.test.kr, prove.test.kr, blopp.se, hogskolaniboras.se
klan-csa.se, kristianstadpower.se, lyrek.se, mirall.se, nl-dnssectest.se
tshirttryck.se, webro.se, xn--botsmarksdck-pcb.se

31 (+2) unnecessary islands:
8.4.e164.arpa, 2.2.0.2.4.6.3.3.6.6.9.4.e164.arpa, 1.2.0.0.1.8.e164.arpa
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa, 42.32.198.in-addr.arpa
178.25.217.in-addr.arpa, 241.75.217.in-addr.arpa
4.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 5.2.0.0.1.6.0.1.0.0.2.ip6.arpa
6.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, 1.0.0.0.e.4.7.c.3.6.8.d.2.0.0.2.ip6.arpa
e.8.1.c.8.0.3.0.1.0.a.2.ip6.arpa, cerebrohidroponico.blog.br, pixaco.com.br
eficacia.eng.br, rev.faelix.net, ipv6.stack.nl, parent.dnssec-test.org
signed.dnssec-test.org, dyn.johani.org, ddns.klubkev.org, autonomica.se
echo-lan.se, shinkuro.se, skabb.se, staver.se, xn--lda-ula.xn--ihrn-dpa.se
zkt.se

97 (-17) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
44 -8 AS25537
12 AS5537
6 +1 AS39570
4 +4 AS28860
4 +4 AS29632
2 +2 AS1103
1 +1 AS3245
1 -1 AS3265
1 +1 AS39858
1 -4 AS15725

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#13 (**permalink**) 01-02-2008, 09:36 AM

Overview of 11647 signed zones:
1495 -1 Entry Point
9618 Test
6 +1 broken chain
453 +13 chained
0 new
75 -22 unreachable

Top 10 autonomous systems injecting DNSSec zones:
720 -13 AS25537
456 AS15725
136 +136 AS1280
81 AS22548
78 AS3333
71 -1 AS3245
46 +1 AS24776
32 AS3265
29 AS39570
21 AS36810

Top 10 TLD containing DNSSec zones:
720 -13 RU
288 +3 ARPA
234 +1 DE
161 +2 COM
121 -1 ORG
100 +1 BR
84 SE
70 -1 BG
53 NET
37 -1 FR

872 (+1) weak keys:
Top 10 autonomous systems injecting weak keys:
690 +1 AS25537
42 -3 AS24776
18 AS3216
15 AS8228
10 +1 AS29632
8 AS20943
4 AS1103
4 AS29344
4 AS12859
3 AS2119

6 (+1) broken DS chains:
228.111.193.in-addr.arpa, sparta.dnsops.biz, llnl.dnsops.gov, bitstring.se
dyn.niconet.se, tgfslp.dalmany.co.uk

27 (-4) parent DS to unsigned zones:
0.20.149.in-addr.arpa, 64.20.149.in-addr.arpa, 157.110.193.in-addr.arpa
178.170.195.in-addr.arpa, 128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa
130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa
133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa
136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa
139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa, blopp.se
hogskolaniboras.se, klan-csa.se, kristianstadpower.se, lyrek.se, mirall.se
nl-dnssectest.se, tshirttryck.se, webro.se, xn--botsmarksdck-pcb.se

33 (+2) unnecessary islands:
8.4.e164.arpa, 2.2.0.2.4.6.3.3.6.6.9.4.e164.arpa, 1.2.0.0.1.8.e164.arpa
64-26.0.149.193.in-addr.arpa, 0.68.193.in-addr.arpa, 42.32.198.in-addr.arpa
178.25.217.in-addr.arpa, 241.75.217.in-addr.arpa
4.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 5.2.0.0.1.6.0.1.0.0.2.ip6.arpa
6.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, e.8.1.c.8.0.3.0.1.0.a.2.ip6.arpa
cerebrohidroponico.blog.br, digitaltv.blog.br, pixaco.com.br
eficacia.eng.br, antd.nist.gov, rev.faelix.net, broken.jelte.nlnetlabs.nl
sub.jelte.nlnetlabs.nl, ipv6.stack.nl, signed.dnssec-test.org
dyn.johani.org, ddns.klubkev.org, autonomica.se, echo-lan.se, shinkuro.se
skabb.se, staver.se, xn--lda-ula.xn--ihrn-dpa.se, zkt.se

75 (-22) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
30 -14 AS25537
12 AS5537
6 AS39570
4 +3 AS24776
2 +1 AS15725
1 AS22894
1 +1 AS9700
1 AS3265
1 AS39858
1 AS7132

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#14 (**permalink**) 01-02-2008, 09:38 AM

* Lutz Donnerhacke wrote:
10 autonomous systems injecting DNSSec zones:
> 136 +136 AS1280

Simple reason: ISC changed their AS.

#15 (**permalink**) 02-04-2008, 02:38 PM

Overview of 11666 signed zones:
1510 +15 Entry Point
9620 +2 Test
4 -2 broken chain
469 +16 chained
0 new
63 -12 unreachable

Top 10 autonomous systems injecting DNSSec zones:
717 -3 AS25537
465 +9 AS15725
137 +1 AS1280
85 +4 AS22548
78 AS3333
71 AS3245
42 -4 AS24776
31 -1 AS3265
28 -1 AS39570
25 +4 AS36810

Top 10 TLD containing DNSSec zones:
717 -3 RU
290 +2 ARPA
233 -1 DE
166 +5 COM
122 +1 ORG
107 +7 BR
88 +4 SE
70 BG
58 +5 NET
34 -3 FR

33 (-839) weak keys:
55.129.in-addr.arpa, 124.32.198.in-addr.arpa, omnity.biz
sandelman.ottawa.on.ca, arakelian.com, gothea.com, intra-links.com
lecorvaisier.com, nikomotos.com, richelieu-consultants.com
agent-factory.de, the-agent-factory.de, bethelks.edu, ll.mit.edu
aarechargement.fr, gigamax.fr, guiraudsa.fr, intra-links.fr, john-nathan.fr
lbpdecoration.fr, lesbeauxpapiers.fr, taplow-consulting.fr, vrai-decor.fr
intra-links.net, rp.secret-wg.org, interlan.se, keyserver.se, skabb.se
spam112.se, staver.se, umdac.se, vfqa.se, zkt.se

4 (-2) broken DS chains:
228.111.193.in-addr.arpa, sparta.dnsops.biz, ch.pr, bitstring.se

25 (-2) parent DS to unsigned zones:
0.20.149.in-addr.arpa, 64.20.149.in-addr.arpa, 157.110.193.in-addr.arpa
178.170.195.in-addr.arpa, 128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa
130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa
133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa
136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa
139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa, blopp.se
hogskolaniboras.se, klan-csa.se, kristianstadpower.se, lyrek.se, mirall.se
tshirttryck.se, xn--botsmarksdck-pcb.se

31 (-2) unnecessary islands:
8.4.e164.arpa, 8.0.6.4.1.4.6.3.9.4.e164.arpa, 3.7.5.1.4.6.3.9.4.e164.arpa
2.2.0.2.4.6.3.3.6.6.9.4.e164.arpa, 1.2.0.0.1.8.e164.arpa
0.68.193.in-addr.arpa, 42.32.198.in-addr.arpa, 178.25.217.in-addr.arpa
241.75.217.in-addr.arpa, 4.2.0.0.1.6.0.1.0.0.2.ip6.arpa
5.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 6.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa
1.0.0.0.e.4.7.c.3.6.8.d.2.0.0.2.ip6.arpa, e.8.1.c.8.0.3.0.1.0.a.2.ip6.arpa
metalplast.bg, cerebrohidroponico.blog.br, digitaltv.blog.br, pixaco.com.br
eficacia.eng.br, tjmg.gov.br, rev.faelix.net, dyn.johani.org, autonomica.se
echo-lan.se, shinkuro.se, skabb.se, staver.se, xn--lda-ula.xn--ihrn-dpa.se
zkt.se

63 (-12) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
25 -5 AS25537
12 AS5537
5 -1 AS39570
3 +3 AS23504
1 AS3265
1 AS7132
1 +1 AS45
1 AS39858
1 -1 AS15725
1 AS24940

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#16 (**permalink**) 02-04-2008, 02:40 PM

> 33 (-839) weak keys:

Classification of weak keys has been changed. Starting with this month
exponent 3 keys are not longer considered as weak. Only keysizes shorter
than 1024 bits for key signing keys are reported here.

#17 (**permalink**) 03-03-2008, 10:38 PM

Overview of 11716 signed zones:
1503 -7 Entry Point
9620 Test
4 broken chain
496 +27 chained
0 new
93 +30 unreachable

Top 10 autonomous systems injecting DNSSec zones:
710 -7 AS25537
466 +1 AS15725
136 -1 AS1280
85 AS22548
78 AS3333
71 AS3245
42 AS24776
31 AS3265
28 AS39570
25 AS36810

Top 10 TLD containing DNSSec zones:
710 -7 RU
291 +1 ARPA
231 -2 DE
170 +4 COM
140 +33 BR
122 ORG
90 +2 SE
71 +1 BG
58 NET
35 +1 FR

31 (-2) weak keys:
55.129.in-addr.arpa, 124.32.198.in-addr.arpa, omnity.biz
sandelman.ottawa.on.ca, arakelian.com, intra-links.com, lecorvaisier.com
nikomotos.com, agent-factory.de, the-agent-factory.de, bethelks.edu
ll.mit.edu, aarechargement.fr, gigamax.fr, guiraudsa.fr, intra-links.fr
john-nathan.fr, lbpdecoration.fr, lesbeauxpapiers.fr, taplow-consulting.fr
vrai-decor.fr, intra-links.net, rp.secret-wg.org, interlan.se, keyserver.se
skabb.se, spam112.se, staver.se, umdac.se, vfqa.se, zkt.se

4 broken DS chains:
228.111.193.in-addr.arpa, sparta.dnsops.biz, ornl.dnsops.gov, bitstring.se

25 parent DS to unsigned zones:
0.20.149.in-addr.arpa, 64.20.149.in-addr.arpa, 157.110.193.in-addr.arpa
178.170.195.in-addr.arpa, 128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa
130.111.89.in-addr.arpa, 131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa
133.111.89.in-addr.arpa, 134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa
136.111.89.in-addr.arpa, 137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa
139.111.89.in-addr.arpa, 140.111.89.in-addr.arpa, blopp.se
hogskolaniboras.se, klan-csa.se, kristianstadpower.se, lyrek.se, mirall.se
tshirttryck.se, xn--botsmarksdck-pcb.se

32 (+1) unnecessary islands:
8.4.e164.arpa, 8.0.6.4.1.4.6.3.9.4.e164.arpa, 3.7.5.1.4.6.3.9.4.e164.arpa
2.2.0.2.4.6.3.3.6.6.9.4.e164.arpa, 1.2.0.0.1.8.e164.arpa
0.68.193.in-addr.arpa, 42.32.198.in-addr.arpa, 178.25.217.in-addr.arpa
241.75.217.in-addr.arpa, 4.2.0.0.1.6.0.1.0.0.2.ip6.arpa
5.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 6.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa
1.0.0.0.e.4.7.c.3.6.8.d.2.0.0.2.ip6.arpa, e.8.1.c.8.0.3.0.1.0.a.2.ip6.arpa
metalplast.bg, cerebrohidroponico.blog.br, digitaltv.blog.br, pixaco.com.br
eficacia.eng.br, tjmg.gov.br, rev.faelix.net, dyn.johani.org
ddns.klubkev.org, autonomica.se, echo-lan.se, shinkuro.se, skabb.se
staver.se, xn--lda-ula.xn--ihrn-dpa.se, zkt.se

93 (+30) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
37 +12 AS25537
12 AS5537
9 +8 AS22548
7 +6 AS15725
6 +1 AS39570
3 +2 AS7132
3 AS23504
2 +1 AS3265
2 +2 AS8228
1 +1 AS20852

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php

#18 (**permalink**) 03-03-2008, 10:41 PM

> Top 10 TLD containing DNSSec zones:
> 140 +33 BR

Main contributor is the ministry of justice. They signed all their subzones.

#19 (**permalink**) 03-03-2008, 10:48 PM

> Top 10 TLD containing DNSSec zones:
> 140 +33 BR

Main contributor is the ministry of justice. They signed all their subzones.

Futhermore some new top level domains got signed:
xn--0zwm56d, xn--11b5bs3a9aj6g, xn--80akhbyknj4f, xn--9t4b11yi5a,
xn--deba0ad, xn--g6w251d, xn--hgbk6aj7f53bba, xn--hlcj6aya9esc7a,
xn--jxalpdlp, xn--kgbechtv, xn--zckzah.
I consider them as test domains, but this shows how far the ICANN reached
their signing practice.

#20 (**permalink**) 04-02-2008, 02:19 PM

Overview of 11791 signed zones:
1482 -21 Entry Point
9621 +1 Test
17 +13 broken chain
585 +89 chained
0 new
86 -7 unreachable

Top 10 autonomous systems injecting DNSSec zones:
697 -13 AS25537
462 -4 AS15725
137 +1 AS1280
86 +1 AS22548
78 AS3333
71 AS3245
70 +70 AS4230
42 AS24776
31 AS3265
28 AS39570

Top 10 TLD containing DNSSec zones:
697 -13 RU
291 ARPA
231 +91 BR
229 -2 DE
165 -5 COM
123 +1 ORG
91 +1 SE
71 BG
57 -1 NET
35 FR

33 (+2) weak keys:
55.129.in-addr.arpa, 124.32.198.in-addr.arpa, omnity.biz, jfce.jus.br
sandelman.ottawa.on.ca, arakelian.com, intra-links.com, lecorvaisier.com
nikomotos.com, agent-factory.de, the-agent-factory.de, bethelks.edu
ll.mit.edu, aarechargement.fr, gigamax.fr, guiraudsa.fr, intra-links.fr
john-nathan.fr, lbpdecoration.fr, lesbeauxpapiers.fr, vrai-decor.fr
intra-links.net, kfuq.net, daedelys.org, rp.secret-wg.org, interlan.se
keyserver.se, skabb.se, spam112.se, staver.se, umdac.se, vfqa.se, zkt.se

17 (+13) broken DS chains:
228.111.193.in-addr.arpa, sparta.dnsops.biz, jfac.jus.br, jfam.jus.br
jfap.jus.br, jfba.jus.br, jfce.jus.br, jfdf.jus.br, jfma.jus.br
jfmg.jus.br, jfpe.jus.br, jfro.jus.br, jfrr.jus.br, trf1.jus.br
ornl.dnsops.gov, ipv4.stack.nl, bitstring.se

26 (+1) parent DS to unsigned zones:
0.20.149.in-addr.arpa, 157.110.193.in-addr.arpa, 178.170.195.in-addr.arpa
128.111.89.in-addr.arpa, 129.111.89.in-addr.arpa, 130.111.89.in-addr.arpa
131.111.89.in-addr.arpa, 132.111.89.in-addr.arpa, 133.111.89.in-addr.arpa
134.111.89.in-addr.arpa, 135.111.89.in-addr.arpa, 136.111.89.in-addr.arpa
137.111.89.in-addr.arpa, 138.111.89.in-addr.arpa, 139.111.89.in-addr.arpa
140.111.89.in-addr.arpa, lobbi.bg, niet.verweg.com, blopp.se
hogskolaniboras.se, klan-csa.se, kristianstadpower.se, lyrek.se, mirall.se
tshirttryck.se, xn--botsmarksdck-pcb.se

30 (-2) unnecessary islands:
8.4.e164.arpa, 9.9.6.2.2.8.4.e164.arpa, 8.0.6.4.1.4.6.3.9.4.e164.arpa
3.7.5.1.4.6.3.9.4.e164.arpa, 2.2.0.2.4.6.3.3.6.6.9.4.e164.arpa
1.2.0.0.1.8.e164.arpa, 0.68.193.in-addr.arpa, 42.32.198.in-addr.arpa
178.25.217.in-addr.arpa, 241.75.217.in-addr.arpa
4.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 5.2.0.0.1.6.0.1.0.0.2.ip6.arpa
6.2.0.0.1.6.0.1.0.0.2.ip6.arpa, 7.2.0.0.1.6.0.1.0.0.2.ip6.arpa
7.f.3.0.8.3.8.0.1.0.0.2.ip6.arpa, 1.0.0.0.e.4.7.c.3.6.8.d.2.0.0.2.ip6.arpa
e.8.1.c.8.0.3.0.1.0.a.2.ip6.arpa, metalplast.bg, cerebrohidroponico.blog.br
digitaltv.blog.br, pixaco.com.br, eficacia.eng.br, bw.nist.gov
rev.faelix.net, signed.dnssec-test.org, autonomica.se, skabb.se, staver.se
xn--lda-ula.xn--ihrn-dpa.se, zkt.se

86 (-7) unreachable zones:
Top 10 autonomous systems containing unreachable zones:
32 -5 AS25537
12 AS5537
8 +1 AS15725
5 -1 AS39570
3 AS1280
3 +3 AS18881
1 AS10466
1 AS24776
1 +1 AS3292
1 AS4436

--
Detailed list: https://www.iks-jena.de/leistungen/dnssec.php