Detailed Monitoring Summary:

DNSSEC Summary
2,486,965 Zones
2,011,137 DNSSEC enabled zones
1,976,755 Zones use both KSKs and ZSKs
183 Zones are serving revoked keys
1,812,421 DNSSEC verified zones
1,982,905 Production DNSSEC-enabled zones
Distribution of key algorithms in use:
Algorithm # Keys
Unknown Algorithm11
DSA-NSEC3-SHA1 [DSA-NSEC3-SHA1]15
DSA/SHA-1 [DSA]219
ECC/GOST [ECC-GOST]115
ECDSA Curve P-256 with SHA-256 [ECDSAP256SHA256]472,875
ECDSA Curve P-384 with SHA-384 [ECDSAP384SHA384]2,318
Private [PRIVATEOID]5
RSA-NSEC3-SHA1 [RSASHA1-NSEC3-SHA1]1,532,905
RSA/MD5 [RSAMD5]24
RSA/SHA-1 [RSASHA1]94,713
RSA/SHA256 [RSASHA256]2,920,894
RSA/SHA512 [RSASHA512]15,524
DANE Summary
36,459 DANE enabled zones with TLSA records
159 PKIX based Trust Anchor TLSA records (Cert Usage 0)
1,187 PKIX based End Entity TLSA records (Cert Usage 1)
1,494 DANE based Trust Anchor TLSA records (Cert Usage 2)
14,192 DANE based End Entity TLSA records (Cert Usage 3)
736 Zones have deployed TLSA for Secure SMTP (Port 465)
285 Zones have deployed TLSA for Secure POP3 (Port 995)
968 Zones have deployed TLSA for SMTP with STARTTLS (Port 587)
89 Zones have deployed TLSA for Alternate SMTP (Port 2525)
9,241 Zones have deployed TLSA for HTTPS (Port 443)
4,526 Zones have deployed TLSA for SMTP (Port 25)
170 Zones have deployed TLSA for POP3 (Port 110)
630 Zones have deployed TLSA for Secure IMAP (Port 993)
387 Zones have deployed TLSA for IMAP (Port 143)

Distribution of RRSIG lifetimes on DNSKEY RRsets