Detailed Monitoring Summary:

DNSSEC Summary
3,920,396 Zones
3,321,537 DNSSEC enabled zones
2,898,277 Zones use both KSKs and ZSKs
306 Zones are serving revoked keys
2,176,873 DNSSEC verified zones
3,140,416 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm105
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]23
DSA/SHA-1 [DSA]79
ECC/GOST [ECC-GOST]56
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]2,061,207
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]44,496
Private [PRIVATEOID]11
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]2,071,809
RSA/MD5 [RSAMD5]18
RSA/SHA-1 [RSASHA1]113,175
RSA/SHA256 [RSASHA256]3,191,227
RSA/SHA512 [RSASHA512]112,303
DANE Summary
180,900 DANE enabled zones with TLSA records
342 PKIX based Trust Anchor TLSA records (Cert Usage 0)
2,926 PKIX based End Entity TLSA records (Cert Usage 1)
3,589 DANE based Trust Anchor TLSA records (Cert Usage 2)
67,338 DANE based End Entity TLSA records (Cert Usage 3)
2,256 Zones have deployed TLSA for Secure SMTP (Port 465)
1,117 Zones have deployed TLSA for Secure POP3 (Port 995)
3,030 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
272 Zones have deployed TLSA for Alternate SMTP (Port 2525)
51,055 Zones have deployed TLSA for HTTPS (Port 443)
12,012 Zones have deployed TLSA for SMTP (Port 25)
847 Zones have deployed TLSA for POP3 (Port 110)
2,196 Zones have deployed TLSA for Secure IMAP (Port 993)
1,410 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets