Some DNS Top Level Domain (TLD) operators publish statistics about their DNS zones. Some others have a zone file access program that allows others to examine their data and publish statistics. Frederic Cambus (@fcambus on Twitter) maintains a site called statdns ( http://www.statdns.com/ ) that keeps statistics for several of the TLDs.
The EDU top level domain is conspicuously absent from the statdns site because the operators don’t publish any statistics and also don’t have a zone file access program in place. The EDU domain has a very complicated operational policy arrangement. It is managed by Educause (a higher education IT consortium), but operated by Verisign, under a contract with the United States Department of Commerce. I recently spoke with colleagues at Educause about current prospects for publishing some statistics or making the zone data available. The good news is that a zone file access program request is in fact in the queue to be approved by the Dept of Commerce. But it’s stuck behind a few other requests, so it may still take some time to come to fruition.
In the meantime, to satisfy my own curiosity, I’ve been looking at other ways to obtain some statistics. In particular I’m interested in seeing how much DNSSEC deployment has happened so far, and how EDU compares with some of the other TLDs in this respect. One way to gain visibility into zone contents is to examine passive DNS databases. A number of folks and organizations run such databases that collect historical information seen from DNS responses at collections of resolvers. By searching records over a period of time in these databases, it’s possible to reconstruct a substantial portion of the active records in a zone. I did this for EDU and analyzed the results recently.
The passive DNS database search managed to find about 7,158 second level domains under EDU. Of these, 6955 domains turned out to be valid (the others probably existed at one point but don’t any more). EDU is known to have in the neighborhood of 7,000 delegations, so this is most probably a pretty good approximation of the active contents of the zone.
EDU Zone Statistics:
Number of Domains from passive DNS db: 7158 Number of Valid Domains: 6955 Total NS records: 19527 Unique NS records: 9757 Number of (glue) IPv4 address records: 4555 Number of (glue) IPv6 address records: 246
DNSSEC Specific Stats for EDU:
Number of DNSSEC Signed Zones: 94 (1.37%) Number of NSEC3 Zones: 29 (30.1% of the signed zones) Number of Zones with DS records: 76 Number of Zones with DLV records at dlv.isc.org: 7
As expected, only a very small fraction (1.37%) of domains have deployed DNSSEC. This compares with about 0.25% in .COM, 0.41% in .NET, and 0.30% in .ORG.
The 94 zones in EDU signed with DNSSEC are:
acadiana.edu baker.edu beloit.edu berkeley.edu bucknell.edu cameron.edu carnegiemellon.edu catc.edu chattanoogastate.edu cltc.edu cmu.edu coloradomesa.edu cookman.edu csupomona.edu cuhk.edu desales.edu drake.edu example.edu fhsu.edu fhtc.edu gfcmsu.edu gsu.edu gtc.edu hfg.edu highlands.edu indiana.edu indianatech.edu internet2.edu iu.edu iub.edu iup.edu iupui.edu jhuapl.edu kestrel.edu kiropraktik.edu k-state.edu ksu.edu kutztown.edu lctcs.edu lsu.edu ltc.edu ma.edu mansfield.edu mcpherson.edu merit.edu mesa.edu millikin.edu mnsfld.edu monmouth.edu monterey.edu mst.edu nau.edu northcentral.edu northshorecollege.edu nwltc.edu okstate.edu pacificu.edu penn.edu pitt.edu psc.edu richland.edu rockefeller.edu rose-hulman.edu scl.edu sdsmt.edu sfcollege.edu shoreline.edu suu.edu tbu.edu tiasnimbas.edu tilburguniversity.edu tiss.edu truman.edu uaa.edu ualr.edu ucaid.edu ucb.edu ucberkeley.edu ucdavis.edu ucr.edu uiowa.edu umbc.edu uni-stuttgart.edu unt.edu untsystem.edu upenn.edu upf.edu usnwc.edu uwm.edu uwstout.edu valencia.edu waketech.edu washjeff.edu weber.edu
The 29 zones that use the NSEC3 variety of DNSSEC are:
csupomona.edu cuhk.edu gfcmsu.edu internet2.edu jhuapl.edu kestrel.edu kiropraktik.edu k-state.edu ksu.edu lsu.edu ma.edu mansfield.edu mcpherson.edu millikin.edu mnsfld.edu pitt.edu richland.edu rose-hulman.edu sdsmt.edu suu.edu tiasnimbas.edu tilburguniversity.edu ualr.edu ucaid.edu ucr.edu uni-stuttgart.edu unt.edu untsystem.edu washjeff.edu
There are 18 zones that do not have DS records published (not sure why):
beloit.edu cameron.edu cookman.edu iup.edu kiropraktik.edu kutztown.edu mansfield.edu merit.edu mnsfld.edu okstate.edu shoreline.edu tbu.edu tiasnimbas.edu uaa.edu usnwc.edu uwm.edu uwstout.edu waketech.edu
There are also 7 zones with DLV records published at ISC’s DLV registry, but this set is disjoint with the set that doesn’t have DS records:
bucknell.edu internet2.edu k-state.edu ksu.edu ualr.edu ucaid.edu ucr.edu
– Shumon Huque