Signed zones prove that a name does not exist with NSEC or NSEC3 records. RFC 9276 recommends NSEC3 with zero extra iterations and no salt; this page measures how many .dk zones follow that, which providers don't, and who publishes CDS/CDNSKEY for automated key rollovers. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.
Based on 73,946 domains probed so far (5.5% of the zone). Our scanners refresh these probes at least every 30 days, so the numbers fill in and settle over the first month.
Of 49,454 signed zones probed, 28,194 (57.0%) use NSEC3, 20,122 (40.7%) use a classic NSEC chain, which lets anyone list every name in the zone, and 1,138 (2.3%) use compact denial (RFC 9824, Cloudflare's "black lies"), which can't be walked. RFC 9276 asks NSEC3 zones for 0 extra iterations and no salt: iterations cost resolvers CPU for no security gain. 13,593 NSEC3 zones (48.2%) still use iterations and 13,617 use a salt; 121 use opt-out.
| Iterations | Zones | Share |
|---|---|---|
| 0 | 14,601 | |
| 1 | 12,348 | |
| 5 | 1 | |
| 7 | 668 | |
| 8 | 2 | |
| 10 | 493 | |
| 20 | 2 | |
| 21 | 2 | |
| 50 | 78 |
| Provider | NSEC3 zones | Iterations > 0 | Salted |
|---|---|---|---|
| one.com | 13,036 | 0.1% | 0.0% |
| dandomain.dk | 6,464 | 100.0% | 100.0% |
| curanet.dk | 3,066 | 100.0% | 100.0% |
| scannet2.dk | 1,352 | 100.0% | 100.0% |
| hyp.net | 783 | 0% | 0.0% |
| wannafind.dk | 504 | 100.0% | 100.0% |
| sitnet.dk | 390 | 100.0% | 100.0% |
| dnsserver.dk | 384 | 100.0% | 100.0% |
| nordicway.dk | 314 | 65.0% | 65.0% |
| e-studio.dk | 249 | 98.4% | 98.4% |
| loopia.se | 187 | 0% | 0.0% |
| 123hotel.dk | 103 | 100.0% | 100.0% |
| aveo.dk | 89 | 100.0% | 100.0% |
| netgiganten.dk | 81 | 97.5% | 97.5% |
| gnrx.dk | 61 | 100.0% | 100.0% |
| simpleagencygroup.dk | 61 | 100.0% | 100.0% |
| wixdns.net | 52 | 100.0% | 100.0% |
| hostonline.dk | 50 | 100.0% | 100.0% |
| dnsadmin.dk | 48 | 85.4% | 100.0% |
| yayhosting.dk | 48 | 100.0% | 100.0% |
| azehosting.net | 47 | 91.5% | 91.5% |
| desec.io | 45 | 0% | 0.0% |
| eurodns.com | 41 | 0% | 0.0% |
| deic.dk | 35 | 0% | 0.0% |
| web-solutions.dk | 35 | 0% | 0.0% |
CDS and CDNSKEY records let a DNS operator hand key rollovers to the registry automatically (RFC 7344/8078). 18,254 of 52,090 signed zones (35.0%) publish them; 39 publish the delete signal, asking the registry to remove their DS and turn DNSSEC off.
| Domain | Iterations | Salt |
|---|---|---|
| 080780.dk | 1 | 1 bytes |
| 0energi.dk | 1 | 1 bytes |
| 1-step-away.dk | 1 | 1 bytes |
| 1-step-up.dk | 1 | 1 bytes |
| 1-utzonplace.dk | 1 | 1 bytes |
| 1001stories.dk | 10 | 10 bytes |
| 1036.dk | 7 | 8 bytes |
| 10klassecentret.dk | 50 | 8 bytes |
| 110310renovering.dk | 1 | 1 bytes |
| 112akuthjaelper.dk | 1 | 1 bytes |
| 123bazar.dk | 1 | 1 bytes |
| 123visitkort.dk | 1 | 1 bytes |
| 13829.dk | 1 | 1 bytes |
| 14a.dk | 1 | 1 bytes |
| 15-3.dk | 7 | 8 bytes |
| 15septemberfonden.dk | 1 | 1 bytes |
| 17mænd.dk | 7 | 8 bytes |
| 1805.dk | 7 | 8 bytes |
| 18alkohol.dk | 10 | 11 bytes |
| 1andre.dk | 1 | 1 bytes |
| 1apo.dk | 1 | 1 bytes |
| 1bach.dk | 1 | 1 bytes |
| 1kid.dk | 1 | 1 bytes |
| 1moore.dk | 1 | 1 bytes |
| 1shot.dk | 7 | 8 bytes |
| 1sl.dk | 7 | 8 bytes |
| 20100030.dk | 7 | 8 bytes |
| 20111610.dk | 1 | 1 bytes |
| 20241515.dk | 1 | 1 bytes |
| 2025denmark.dk | 10 | 12 bytes |
| 22100200.dk | 1 | 1 bytes |
| 22223333.dk | 1 | 1 bytes |
| 247-laaseservice.dk | 1 | 1 bytes |
| 24timersloeb.dk | 1 | 1 bytes |
| 262.dk | 1 | 1 bytes |
| 26222299.dk | 7 | 8 bytes |
| 2770.dk | 1 | 1 bytes |
| 2assist.dk | 1 | 1 bytes |
| 2b-business.dk | 1 | 1 bytes |
| 2cv-experten.dk | 1 | 1 bytes |
| 2dohost.dk | 1 | 1 bytes |
| 2embrace.dk | 1 | 1 bytes |
| 2field.dk | 1 | 1 bytes |
| 2helpu.dk | 1 | 1 bytes |
| 2m2.dk | 1 | 1 bytes |
| 2mdata.dk | 1 | 1 bytes |
| 2ndtonone.dk | 1 | 1 bytes |
| 2note.dk | 1 | 1 bytes |
| 2od.dk | 1 | 1 bytes |
| 2peter.dk | 1 | 1 bytes |