Detailed Monitoring Summary:

DNSSEC Summary
2,725,889 Zones
2,157,223 DNSSEC enabled zones
2,058,983 Zones use both KSKs and ZSKs
241 Zones are serving revoked keys
1,852,738 DNSSEC verified zones
2,106,680 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm36
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]27
DSA/SHA-1 [DSA]294
ECC/GOST [ECC-GOST]122
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]630,023
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]16,626
Private [PRIVATEOID]10
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]1,864,947
RSA/MD5 [RSAMD5]26
RSA/SHA-1 [RSASHA1]68,572
RSA/SHA256 [RSASHA256]3,116,798
RSA/SHA512 [RSASHA512]10,565
DANE Summary
49,345 DANE enabled zones with TLSA records
239 PKIX based Trust Anchor TLSA records (Cert Usage 0)
2,371 PKIX based End Entity TLSA records (Cert Usage 1)
2,324 DANE based Trust Anchor TLSA records (Cert Usage 2)
35,964 DANE based End Entity TLSA records (Cert Usage 3)
1,545 Zones have deployed TLSA for Secure SMTP (Port 465)
705 Zones have deployed TLSA for Secure POP3 (Port 995)
2,104 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
187 Zones have deployed TLSA for Alternate SMTP (Port 2525)
24,739 Zones have deployed TLSA for HTTPS (Port 443)
8,668 Zones have deployed TLSA for SMTP (Port 25)
476 Zones have deployed TLSA for POP3 (Port 110)
1,566 Zones have deployed TLSA for Secure IMAP (Port 993)
909 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets