{"id":18460,"date":"2022-07-27T15:33:29","date_gmt":"2022-07-27T15:33:29","guid":{"rendered":"https:\/\/prensa.lacnic.net\/news?p=18460"},"modified":"2022-08-17T14:42:32","modified_gmt":"2022-08-17T14:42:32","slug":"dnssec-deployment-in-the-region-statistics-and-measurements","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/dnssec-deployment-in-the-region-statistics-and-measurements\/","title":{"rendered":"DNSSEC Deployment in the Region \u2013 Statistics and Measurements"},"content":{"rendered":"\n

By Hugo Salgado, <\/em>Research and Development at NIC Chile; Dario Gomez Technology Consultant; Alejandro Acosta <\/em>R+D Coordinator at LACNIC<\/p>\n\n\n\n

Introduction<\/strong><\/p>\n\n\n\n

In this article we would like to talk about some recent studies we have conducted on a topic we are very passionate about: DNSSEC. Note that we are using the plural term \u201cstudies\u201d, as there are two studies on DNSSEC that we began at the same time\u2026 please continue reading to find out what these two studies are about!<\/p>\n\n\n\n

About DNSSEC<\/strong><\/p>\n\n\n\n

DNSSEC incorporates additional security to the DNS protocol, as it allows checking the integrity and authenticity of the data, preventing spoofing and tampering attacks through the use of asymmetric cryptography, better known as public\/private key cryptography. By using these keys and digital signatures based on public key cryptography, it is possible to determine whether a query has been altered, which allows guaranteeing the integrity and authenticity of the message. If these signatures are checked and they do not match, it means that the chain of trust has been broken and the query cannot be validated as legitimate.<\/p>\n\n\n\n

Having DNSSEC depends on your ISP or Internet service provider, who is the one responsible for configuring the protocol. There are several different tools to find out if you have DNSSEC, such as the following:<\/p>\n\n\n\n

https:\/\/dnssec-analyzer.verisignlabs.com\/<\/a><\/p>\n\n\n\n

https:\/\/dnsviz.net\/<\/a><\/p>\n\n\n\n

As many already know, the DNSSEC protocol has been growing a lot in recent years. Four aspects have marked the growth of DNSSEC deployment:<\/p>\n\n\n\n

  1. DNSSEC is enabled by default on some recursive servers (BIND).<\/li>
  2. Great progress has been achieved in making it easier for major registrars to enable DNSSEC on the different domains.<\/li>
  3. All major recursive DNS servers perform DNSSEC validation (Google Public DNS, Cloudflare, Quad9, etc.).<\/li>
  4. Apple very recently informed that iOS16 and macOS Ventura will allow DNSSEC validation at the stub resolver.<\/li><\/ol>\n\n\n\n

    DNSSEC has always been very important for LACNIC, and we have organized many events and activities around this topic. However, to date we had never conducted our own study on the matter.<\/p>\n\n\n\n

    What is the study about?<\/strong><\/p>\n\n\n\n

    LACNIC’s R&D department wanted to carry out a study to understand the status and progress of DNSSEC deployment in the region.<\/p>\n\n\n\n

    Data sources<\/strong><\/p>\n\n\n\n

    We have two very reliable data sources:<\/p>\n\n\n\n