1. DNSSEC & KSK Rollover Patrick Jones Middle East DNS Forum & APTLD 75
21 February 2019

2. What is DNSSEC? DNSSEC = “DNS Security Extensions”
DNSSEC is a protocol that is currently being deployed to secure the Domain Name System (DNS)
DNSSEC adds security to the DNS by incorporating public key cryptography into the DNS hierarchy, resulting in a single, open, global Public Key Infrastructure (PKI) for domain names
Result of over a decade of community based, open standards development
Implemented in the root zone in 2010

3. State of DNSSEC Deployment at MEDNSF 2019
Over 90% of top-level domains are signed with DNSSEC
1532 TLDs in the root, 1398 are signed (reduction of 11 since MEDNSF 2018)
1386 TLDs have trust anchors published
About 50% of ccTLDs are signed
Recent adoption in Mauritania’s IDN ccTLD on 30 Jan 2019 & .DZ on 5 Feb 2019

4. State of DNSSEC Deployment as of 20 Feb 2019

5. State of DNSSEC Deployment (source: ISOC Deploy360)

6. State of DNSSEC Deployment (source: ISOC Deploy360)

7. KSK Rollover

8. KSK Rollover Project
Goal: Replace the key (KSK) used to sign the DNS root zone's DNSSEC key set since 2010 without disruption
Passed many milestones, a few more to go
Next up: removing the revocation record for the out-going KSK on 22 March 2019

9. Plans Made; Key Created
Where It Is
2015
2016
2017
2018
2019
Design Team
Plans Made; Key Created
Publicize;
The "Pause"
Publicize;
Change Key
Revoke; Clean Up
A key rollover can be done more quickly, but "going fast" has never been the goal

10. Audience Actions
Have you done nothing so far and have seen no problems?
Continue what you are doing!
Have you been relying on Automated Updates (RFC 5011)?
Are you manually managing the configuration of DNSSEC trust anchors?
Remove the old key (2010) from trust anchors.

11. For More Information 1 2 3 4 Visit https://icann.org/kskroll
Join the conversation online
Use the hashtag #KeyRoll
Sign up to the mailing list
Ask a question to
Subject line: “KSK Rollover”
Attend an event
Visit to find upcoming KSK rollover presentations in your region 2 3 4

12. Engage with ICANN – Thank You and Questions