🧮 NSEC3 & CDS

Authenticated denial (NSEC vs NSEC3), RFC 9276 iteration compliance and automated key rollover (CDS/CDNSKEY) · all insights

Signed zones prove that a name does not exist with NSEC or NSEC3 records. RFC 9276 recommends NSEC3 with zero extra iterations and no salt; this page measures how many .dk zones follow that, which providers don't, and who publishes CDS/CDNSKEY for automated key rollovers. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.

Based on 93,807 domains probed so far (7.2% of the zone). A domain's probe is refreshed with every full scan, and otherwise roughly every 30–35 days, so while the first pass is still filling in the numbers can shift.

🧮 NSEC3 iterations

Of 62,743 signed zones probed whose denial of existence we could see (a signed wildcard zone answers every name, so it shows none), 35,827 (57.1%) use NSEC3, 25,452 (40.6%) use a classic NSEC chain, which lets anyone list every name in the zone, and 1,464 (2.3%) use compact denial (RFC 9824, Cloudflare's "black lies"), which can't be walked. RFC 9276 asks NSEC3 zones for 0 extra iterations and no salt: iterations cost resolvers CPU for no security gain. 17,340 NSEC3 zones (48.4%) still use iterations and 17,375 use a salt; 166 use opt-out.

IterationsZonesShare
018,489
51.6%
115,771
44.0%
51
0.0%
7841
2.3%
82
0.0%
10623
1.7%
121
0.0%
202
0.0%
212
0.0%
5097
0.3%

List the zones with iterations > 0 →

🏢 NSEC3 by DNS provider

ProviderNSEC3 zonesIterations > 0Salted
one.com16,4470.1%0.1%
dandomain.dk8,297100.0%100.0%
curanet.dk3,921100.0%100.0%
scannet2.dk1,694100.0%100.0%
hyp.net1,0040%0.0%
wannafind.dk631100.0%100.0%
sitnet.dk490100.0%100.0%
dnsserver.dk487100.0%100.0%
nordicway.dk39264.0%64.0%
e-studio.dk32898.5%98.5%
loopia.se2700%0.0%
123hotel.dk142100.0%100.0%
aveo.dk115100.0%100.0%
netgiganten.dk9998.0%98.0%
simpleagencygroup.dk78100.0%100.0%
gnrx.dk72100.0%100.0%
wixdns.net70100.0%100.0%
hostonline.dk69100.0%100.0%
dnsadmin.dk6185.2%100.0%
yayhosting.dk61100.0%100.0%
desec.io580%0.0%
azehosting.net5492.6%92.6%
eurodns.com510%0.0%
web-solutions.dk490%0.0%
deic.dk390%0.0%

🔄 CDS / CDNSKEY (automated DS updates)

CDS and CDNSKEY records let a DNS operator hand key rollovers to the registry automatically (RFC 7344/8078). 23,091 of the 66,297 signed zones we asked (34.8%) publish them; 51 publish the delete signal, asking the registry to remove their DS and turn DNSSEC off.

📋 Zones with NSEC3 iterations > 0

19,066 zones
DomainIterationsSalt
2embrace.dk11 bytes
2field.dk11 bytes
2helpu.dk11 bytes
2m2.dk11 bytes
2mdata.dk11 bytes
2ndtonone.dk11 bytes
2note.dk11 bytes
2od.dk11 bytes
2peter.dk11 bytes
2sms.dk11 bytes
2spartner.dk11 bytes
2united.dk11 bytes
2værelses.dk11 bytes
3-1.dk11 bytes
3-biltilbud.dk11 bytes
3-design.dk11 bytes
30408330.dk11 bytes
30dage.dk11 bytes
32220102.dk11 bytes
3255.dk11 bytes
33110061.dk11 bytes
3460.dk78 bytes
35553331.dk11 bytes
360-følgeskab.dk11 bytes
360cykeldele.dk11 bytes
360navis.dk11 bytes
36174500.dk11 bytes
365arkitekterne.dk11 bytes
365basyd.dk11 bytes
365pim.dk11 bytes
365secure.dk11 bytes
366.dk78 bytes
3760gudhjem.dk11 bytes
37c.dk11 bytes
39560002.dk11 bytes
3atravel.dk11 bytes
3cm.dk11 bytes
3d-i.dk11 bytes
3d-printing.dk11 bytes
3d-train.dk11 bytes
3dhnn.dk11 bytes
3dlaser.dk11 bytes
3dregistrering.dk11 bytes
3dtyverisikring.dk11 bytes
3ffemern.dk11 bytes
3fuddannelsesnyt.dk11 bytes
3hconsult.dk11 bytes
3komma14.dk11 bytes
3manden.dk11 bytes
3nlak.dk11 bytes
dhd.dk [/] search Domains, Hosts & DNS — .dk zone