Almost nobody signs their zones with DNSSEC. On the Moz 500 list of most popular domains (is there a better list? I'd like to make this point more forcefully), I found just twenty-nine with DS records. Paypal and Salesforce are the only major tech firms that DNSSEC-sign their domains. The companies that don't include those with the largest, most competent security teams.
There have been years in the last several where DNSSEC has lost adoption.
tptacek|3 years ago
There have been years in the last several where DNSSEC has lost adoption.