Detailed Monitoring Summary:

DNSSEC Summary
2,666,275 Zones
2,127,223 DNSSEC enabled zones
2,078,436 Zones use both KSKs and ZSKs
173 Zones are serving revoked keys
1,877,980 DNSSEC verified zones
2,080,427 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm21
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]23
DSA/SHA-1 [DSA]209
ECC/GOST [ECC-GOST]119
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]491,259
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]8,669
Private [PRIVATEOID]5
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]1,588,020
RSA/MD5 [RSAMD5]22
RSA/SHA-1 [RSASHA1]64,076
RSA/SHA256 [RSASHA256]3,100,333
RSA/SHA512 [RSASHA512]10,034
DANE Summary
40,946 DANE enabled zones with TLSA records
174 PKIX based Trust Anchor TLSA records (Cert Usage 0)
1,393 PKIX based End Entity TLSA records (Cert Usage 1)
1,806 DANE based Trust Anchor TLSA records (Cert Usage 2)
22,953 DANE based End Entity TLSA records (Cert Usage 3)
911 Zones have deployed TLSA for Secure SMTP (Port 465)
398 Zones have deployed TLSA for Secure POP3 (Port 995)
1,256 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
119 Zones have deployed TLSA for Alternate SMTP (Port 2525)
16,365 Zones have deployed TLSA for HTTPS (Port 443)
5,613 Zones have deployed TLSA for SMTP (Port 25)
248 Zones have deployed TLSA for POP3 (Port 110)
906 Zones have deployed TLSA for Secure IMAP (Port 993)
510 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets