Decoding DNSSEC Errors at Scale: An Automated DNSSEC Error Resolution Framework using Insights from DNSViz Logs
Low adoption and high misconfiguration rates continue to blunt the security benefits of DNSSEC. Drawing on 1.1M historical diagnostic snapshots covering 319K second-level and their subdomains between 2020 and 2024 from the DNSViz service, this paper delivers the first longitudinal, data-driven taxonomy of real-world DNSSEC failures. The study shows that NSEC3 misconfigurations, delegation failures and missing/expired signatures account for more than 70% of all bogus states, and that 18% of such domains remain broken.
Authors
- Md. Ishtiaq Ashiq (ORCID: https://orcid.org/0000-0001-8282-6225)
- Casey T. Deccio (ORCID: https://orcid.org/0000-0003-0938-375X)
- Olivier Hureau (ORCID: https://orcid.org/0009-0007-4647-1579)
- Taejoong Chung (ORCID: https://orcid.org/0000-0002-4323-4080)
Institutions
- Brigham Young University (US)
- Institut polytechnique de Grenoble (FR)
- Centre National de la Recherche Scientifique (FR)
- Laboratoire d'Informatique de Grenoble (FR)
- Virginia Tech (US)
- Université Grenoble Alpes (FR)
Publication Details
- Published
- 2025-10-28
- DOI
- https://doi.org/10.1145/3730567.3764428
- Primary Topic
- IPv6, Mobility, Handover, Networks, Security
- Type
- article
- Field-Weighted Citation Impact
- 0.00