Detailed Monitoring Summary:

DNSSEC Summary
2,428,278 Zones
1,852,839 DNSSEC enabled zones
1,753,797 Zones use both KSKs and ZSKs
173 Zones are serving revoked keys
1,489,450 DNSSEC verified zones
1,815,043 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm55
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]20
DSA/SHA-1 [DSA]213
ECC/GOST [ECC-GOST]61
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]735,217
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]12,765
Private [PRIVATEOID]8
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]1,414,328
RSA/MD5 [RSAMD5]18
RSA/SHA-1 [RSASHA1]57,132
RSA/SHA256 [RSASHA256]2,114,253
RSA/SHA512 [RSASHA512]25,538
DANE Summary
54,447 DANE enabled zones with TLSA records
271 PKIX based Trust Anchor TLSA records (Cert Usage 0)
2,475 PKIX based End Entity TLSA records (Cert Usage 1)
2,637 DANE based Trust Anchor TLSA records (Cert Usage 2)
40,280 DANE based End Entity TLSA records (Cert Usage 3)
1,811 Zones have deployed TLSA for Secure SMTP (Port 465)
834 Zones have deployed TLSA for Secure POP3 (Port 995)
2,447 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
215 Zones have deployed TLSA for Alternate SMTP (Port 2525)
27,210 Zones have deployed TLSA for HTTPS (Port 443)
9,714 Zones have deployed TLSA for SMTP (Port 25)
584 Zones have deployed TLSA for POP3 (Port 110)
1,783 Zones have deployed TLSA for Secure IMAP (Port 993)
1,065 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets