If you have been receiving our DNSSEC deployment maps by email or just using the maps from our web page, you need to know an important fact:
The maps we’ve been publishing recently have had the incorrect status set for several countries.
The maps published last week on October 14, 2014, (and the ones distributed via email today) have now been fully verified to have the correct status of all country-code top-level domains (ccTLDs).
The maps are correct today!
To explain a bit more, in preparation for last week’s DNSSEC Workshop at ICANN 51 I was puzzled by something that didn’t seem right with we were publishing. Specifically, Australia was showing up in a September map as having a “DS in Root” when I knew for a fact that .AU did not (and could easily confirm using “dig” at the command-line). Diving into the issue more, I discovered what happened.
One of the strengths of our set of DNSSEC deployment maps is that we track 5 stages of DNSSEC deployment versus simply showing whether they are publishing a DS in the root zone. This allows us to do some forward projection to what we think the state of DNSSEC deployment may be in the future based on statements made by various ccTLDs about their plans for DNSSEC deployment.
But what if those plans don’t work out exactly right?
Our database contains records for each ccTLD based on both factual data (such as whether they have a DS record in the root zone) and observed information that could be from announcements, presentations at industry conferences, blog posts, email messages, etc.
In this case, there were forward-looking records for a number of ccTLDs that had been entered into the database but then had not actually happened on the projected dates. For whatever reasons, various plans and public statements did not hit their target dates.
I spent my plane flight out to Los Angeles going through the tedious exercise of comparing our database with a list of TLDs that had a DS in the root zone, and then followed that up with further confirmations once I had Internet access in L.A. The end result is that I identified the forward-looking records that needed to be changed and updated our database in time to generate the maps I needed for last Wednesday’s workshop.
I also identified a hole in our process where I was not routinely checking the forward-looking records to be sure that they were in fact happening. This is all part of the learning process after we took on maintenance of these maps from Shinkuro, Inc., earlier in 2014. Now we’ll be sure to check this in the future.
I do apologize if anyone used these maps in recent presentations over the past few months. We’ll be working to make sure they stay updated in the time ahead.
By the way, if you do want to receive these DNSSEC deployment maps by email each week, you can subscribe to the public email list. The maps are distributed via email each Monday morning, along with comma-separated value (CSV) files containing the DNSSEC status of all the ccTLDs and the generic TLDs (gTLDs).
And… if you want to get started with DNSSEC yourself, please visit our Start Here page to find resources aimed at your type of organization or role.
