From Binary to Maturity: A Five-Level Model for Measuring and Advancing DNSSEC Deployment Across Top-Level Domains

This preprint reports a measurement study of DNSSEC deployment maturity across 201 top-level domains, measured on 4 July 2026. DNSSEC deployment is often reported as a binary condition: a top-level domain either has a DS record at its parent zone or it does not. This view hides a wide range of outcomes among nominally signed domains, from delegations that fail chain-of-trust validation, to zones signed with algorithms the IETF has since deprecated, to zones that validate cleanly but deviate from current operational guidance. We measured 201 top-level domains (174 country-code TLDs across Africa, Latin America, Europe, North America, and Asia-Pacific, plus 27 widely used generic and sponsored TLDs) and classified each into a five-level maturity model: Unsigned, Broken/Bogus, Weak Cryptography, Hygiene Gaps, and Fully Conformant. Classification combined chain-of-trust validation status with algorithm, key-size, and NSEC3-parameter checks against RFC 8624, its successor registry regime under RFCs 9904 and 9905, and RFC 9276. We found 48 domains (23.9%) unsigned, 54 (26.9%) signed with cryptography below current recommended strength, 31 (15.4%) cryptographically sound but deviating from NSEC3 hygiene guidance, and 68 (33.8%) fully conformant; no broken chain of trust was observed. In every region measured, between 48% and 86% of domains fall short of full conformance. The dominant weakness, a legacy 1024-bit RSA zone-signing key retained alongside a 2048-bit key-signing key, persists in 2026 at the TLD apex itself and appears independent of registry resourcing. All unusual results were independently re-verified using raw dig queries and manual RSA modulus decoding.