Detailed Monitoring Summary:

DNSSEC Summary
2,661,267 Zones
2,134,046 DNSSEC enabled zones
2,089,601 Zones use both KSKs and ZSKs
226 Zones are serving revoked keys
1,898,869 DNSSEC verified zones
2,086,663 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm20
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]20
DSA/SHA-1 [DSA]240
ECC/GOST [ECC-GOST]118
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]511,576
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]4,634
Private [PRIVATEOID]5
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]1,765,414
RSA/MD5 [RSAMD5]26
RSA/SHA-1 [RSASHA1]95,707
RSA/SHA256 [RSASHA256]3,198,774
RSA/SHA512 [RSASHA512]18,489
DANE Summary
40,048 DANE enabled zones with TLSA records
170 PKIX based Trust Anchor TLSA records (Cert Usage 0)
1,265 PKIX based End Entity TLSA records (Cert Usage 1)
1,635 DANE based Trust Anchor TLSA records (Cert Usage 2)
21,140 DANE based End Entity TLSA records (Cert Usage 3)
851 Zones have deployed TLSA for Secure SMTP (Port 465)
352 Zones have deployed TLSA for Secure POP3 (Port 995)
1,160 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
98 Zones have deployed TLSA for Alternate SMTP (Port 2525)
15,063 Zones have deployed TLSA for HTTPS (Port 443)
5,217 Zones have deployed TLSA for SMTP (Port 25)
208 Zones have deployed TLSA for POP3 (Port 110)
806 Zones have deployed TLSA for Secure IMAP (Port 993)
455 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets