DNSSEC in 2026: widely validated, almost never signed

DNSSEC has two sides, and different numbers belong to each.

Signing is the domain owner’s job: the zone is signed and a DS record is published in the parent zone. Without it there is nothing to protect.

Validation is the resolver’s job — the ISP or public DNS the visitor happens to use. Without it nobody checks the signature.

The two cannot be mixed: a country can validate signatures widely and barely sign its own domains. That is exactly what we observe.

APNIC Labs measures the share of users whose resolver validates signatures, updated daily. As of 24 August 2026, 30-day window:

Russian users get signature validation more often than the world average — by more than nine percentage points. That is the doing of ISPs and public resolvers, not of websites.

An important caveat about trends. The Russian figure swings year to year:

A two-fold spread. The reason lies in what is measured: users, not networks. When one large ISP switches validation on or off, the national share moves at once. Year-over-year "trends" on this series are meaningless — pick two points and you can show growth or decline at will.

On 27 August 2026 we checked for a DS record on domains users had brought to our tools — a dig DS query against a public resolver, on the registrable name:

Russian domains are signed roughly ten times less often than .com and twenty-four times less often than .org. In our sample exactly one domain of a hundred and twenty-six carries a signature.

Sampling caveat: these are domains somebody brought to our tools, not a random slice of the zone. Comparing zones to each other is sound — they were collected the same way — but the .ru level cannot stand in for "the Russian web". Not a single query failed, so "unsigned" here means an absent DS record rather than a failed lookup.

Put the two tables together. DNSSEC protects a Russian user more often than the average person on the planet. A Russian website protects its visitor less often than a site in any zone we compared.

The practical meaning: nearly half of Russian users reach the web through a resolver that will check a signature if one exists. For a domain owner that makes signing not a forward-looking gesture — the validating side is already in place and waiting.

And the converse: until the domain is signed, those 47.6% do nothing for it. There is nothing to check.

The data says how much, not why. Here we step past what was measured, so these are factors rather than a cause:

• Registrar support. Signing requires the registrar to accept a DS record and pass it to the registry. Where the control panel offers no such field, the owner simply cannot finish the job.
• The cost of a mistake is high and one-sided. A bad signature or a missed key rollover makes the domain unreachable for everyone who validates — in Russia, for nearly half the visitors. Not deploying DNSSEC never breaks anything.
• Changing DNS hosting gets harder. Moving a signed zone needs a coordinated key change; without one the domain goes dark while the two sides disagree.
• The benefit is invisible. Unlike a certificate, DNSSEC draws no padlock, affects no ranking and shows up in no analytics dashboard.

Check your own domain with the DNS lookup tool; what the records are and why each exists — what a domain is.