Hi, Am 12.06.2012 15:58, schrieb Andrei Robachevsky:
Assuming these are all valid queries (i.e. not belonging to the 98% of malformed queries root servers usually get), what fraction of the total valid queries does this constitute?
Would the actual DNSSEC penetration rate be different from this number (e.g. due to possible differences in caching, etc.)?
A validating resolver should query the root DNSKEY about once per day (TTL/2) and a non-validating resolver not at all. With 1 q/s this would make an estimate of at most 86k validating resolvers for K, minus extra or malformed queries. The fraction of malformed queries is probably not that large as validation seems to be disabled by default on most systems (one must willfully enable validation without noticing that resolution is broken). This number is a nice validation indicator but does not say anything about the actual number of DNSSEC-enabled queries. The number of queries with the DNSSEC OK flag set [1] is neither suitable, as it indicates all DNSSEC-capable resolvers, not just the DNSSEC-enabled ones. Kind regards, Matt [1] http://k.root-servers.org/statistics/ROOT/dnssec.html