[thegagne]

Efficiency and ease of adoption would be my guess.

The APNIC Ping podcast did an excellent 2 part series on the problems of DNSSEC. It puts more responsibility on the DNS systems that are already complex and doing a lot of work.

The CA system with root trusts is just super efficient and easy, so it won.

It’s not perfect, so I’m sure someday it will be replaced, but not by the current options.

[tptacek]

Based on this Geoff Huston post:

https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/