Further to Olaf Kolkman's question at the meeting: we publish the number of queries with DNSOK set continuously at http://k.root-servers.org/statistics/ROOT/dnssec.html This can be at all times compared to http://k.root-servers.org/statistics/ROOT/nodes.html So the answer to Olaf's question is that at present roughly two thirds of the queries arriving at k-root have the DO-bit set.
On Apr 19, 2012, at 8:46 PM, Daniel Karrenberg wrote:
Further to Olaf Kolkman's question at the meeting: we publish the number of queries with DNSOK set continuously at
http://k.root-servers.org/statistics/ROOT/dnssec.html
This can be at all times compared to
http://k.root-servers.org/statistics/ROOT/nodes.html
So the answer to Olaf's question is that at present roughly two thirds of the queries arriving at k-root have the DO-bit set.
Thanks Daniel, But my question was not statistics about the OK bit (that measures DNSSEC able servers in the field) but about queries for the DNSKEY RRset, since the amount of those queries correlates with the amount of DNSSEC validation that is actually happening. The RIPE NCC staff has been so kind to generate such graph on request, but it would be very nice to have that data available life. Even though the graphs do not demonstrate a significant growth at the moment. --Olaf ________________________________________________________ Olaf M. Kolkman NLnet Labs http://www.nlnetlabs.nl/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Olaf, On 12/04/20 09:09 , Olaf Kolkman wrote:
On Apr 19, 2012, at 8:46 PM, Daniel Karrenberg wrote:
Further to Olaf Kolkman's question at the meeting: we publish the number of queries with DNSOK set continuously at
http://k.root-servers.org/statistics/ROOT/dnssec.html
This can be at all times compared to
http://k.root-servers.org/statistics/ROOT/nodes.html
So the answer to Olaf's question is that at present roughly two thirds of the queries arriving at k-root have the DO-bit set.
Thanks Daniel,
But my question was not statistics about the OK bit (that measures DNSSEC able servers in the field) but about queries for the DNSKEY RRset, since the amount of those queries correlates with the amount of DNSSEC validation that is actually happening.
The RIPE NCC staff has been so kind to generate such graph on request, but it would be very nice to have that data available life. Even though the graphs do not demonstrate a significant growth at the moment.
We can certainly investigate the possibility of providing this information on a regular basis. I assume that, given the current change rate, daily updates would suffice, or are you really looking at life as in real time? Cheers, Romeo -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk+RFs0ACgkQGRL9suBV+eqU4ACfe+WueuOdGuRjb65TR7CVGGpp 7ooAniIC4L+OBxVXQtmcMGKTY00ND2/e =hnoT -----END PGP SIGNATURE-----
On Apr 19, 2012, at 9:57 PM, Romeo Zwart wrote:
We can certainly investigate the possibility of providing this information on a regular basis. I assume that, given the current change rate, daily updates would suffice, or are you really looking at life as in real time?
Quarterly would be good enough.. ________________________________________________________ Olaf M. Kolkman NLnet Labs http://www.nlnetlabs.nl/
Hi Romeo/Olaf, On 20 apr. 2012, at 09:57, Romeo Zwart wrote:
Thanks Daniel,
But my question was not statistics about the OK bit (that measures DNSSEC able servers in the field) but about queries for the DNSKEY RRset, since the amount of those queries correlates with the amount of DNSSEC validation that is actually happening.
The RIPE NCC staff has been so kind to generate such graph on request, but it would be very nice to have that data available life. Even though the graphs do not demonstrate a significant growth at the moment.
We can certainly investigate the possibility of providing this information on a regular basis. I assume that, given the current change rate, daily updates would suffice, or are you really looking at life as in real time?
We've created similar statistics in the past and saw low but promising numbers for our own signed domains; obviously statistics for the root zone would be more significant in this respect. I'm not familiar enough with your setup to judge what would be a reasonable frequency but daily updates sounds good to me. Cheers, Roland -- Roland M. van Rijswijk -- SURFnet Middleware Services -- t: +31-30-2305388 -- e: roland.vanrijswijk@surfnet.nl
participants (4)
-
Daniel Karrenberg -
Olaf Kolkman -
Roland van Rijswijk -
Romeo Zwart