Signed zones prove that a name does not exist with NSEC or NSEC3 records. RFC 9276 recommends NSEC3 with zero extra iterations and no salt; this page measures how many .dk zones follow that, which providers don't, and who publishes CDS/CDNSKEY for automated key rollovers. Data comes from our own scanners, which re-resolve every .dk domain in the zone roughly once a week.
Based on 55,778 domains probed so far (4.1% of the zone). Our scanners refresh these probes at least every 30 days, so the numbers fill in and settle over the first month.
Of 37,234 signed zones probed, 21,138 (56.8%) use NSEC3, 15,239 (40.9%) use a classic NSEC chain, which lets anyone list every name in the zone, and 857 (2.3%) use compact denial (RFC 9824, Cloudflare's "black lies"), which can't be walked. RFC 9276 asks NSEC3 zones for 0 extra iterations and no salt: iterations cost resolvers CPU for no security gain. 10,189 NSEC3 zones (48.2%) still use iterations and 10,210 use a salt; 92 use opt-out.
| Iterations | Zones | Share |
|---|---|---|
| 0 | 10,949 | |
| 1 | 9,259 | |
| 5 | 1 | |
| 7 | 504 | |
| 8 | 1 | |
| 10 | 366 | |
| 20 | 2 | |
| 21 | 2 | |
| 50 | 54 |
| Provider | NSEC3 zones | Iterations > 0 | Salted |
|---|---|---|---|
| one.com | 9,770 | 0.1% | 0.1% |
| dandomain.dk | 4,859 | 100.0% | 100.0% |
| curanet.dk | 2,286 | 100.0% | 100.0% |
| scannet2.dk | 1,019 | 100.0% | 100.0% |
| hyp.net | 587 | 0% | 0.0% |
| wannafind.dk | 378 | 100.0% | 100.0% |
| sitnet.dk | 292 | 100.0% | 100.0% |
| dnsserver.dk | 286 | 100.0% | 100.0% |
| nordicway.dk | 235 | 64.7% | 64.7% |
| e-studio.dk | 184 | 98.9% | 98.9% |
| loopia.se | 150 | 0% | 0.0% |
| 123hotel.dk | 78 | 100.0% | 100.0% |
| netgiganten.dk | 64 | 96.9% | 96.9% |
| aveo.dk | 64 | 100.0% | 100.0% |
| simpleagencygroup.dk | 51 | 100.0% | 100.0% |
| gnrx.dk | 41 | 100.0% | 100.0% |
| dnsadmin.dk | 39 | 87.2% | 100.0% |
| azehosting.net | 37 | 94.6% | 94.6% |
| wixdns.net | 35 | 100.0% | 100.0% |
| hostonline.dk | 35 | 100.0% | 100.0% |
| desec.io | 34 | 0% | 0.0% |
| yayhosting.dk | 33 | 100.0% | 100.0% |
| eurodns.com | 28 | 0% | 0.0% |
| deic.dk | 27 | 0% | 0.0% |
| web-solutions.dk | 26 | 0% | 0.0% |
CDS and CDNSKEY records let a DNS operator hand key rollovers to the registry automatically (RFC 7344/8078). 13,834 of 39,260 signed zones (35.2%) publish them; 32 publish the delete signal, asking the registry to remove their DS and turn DNSSEC off.