An Explanation of CDS Daily Charts
This page contains explanations for each of the charts found on the CDS Daily Charts page. For deeper analysis about what is shown and the project as a whole, you should read the CDS/DNSKEY observation project page.
1. Domains with DS records that also have CDS records
This chart shows the percentage of domains across all observed TLDs that have a DS record in the parent zone and also publish a CDS record in their own zone. DS records are placed by a registry in the parent zone to enable DNSSEC validation for a domain. A CDS record is a child-side signal expressing what DS records should be present in the parent. A domain publishing both records might be participating in the automated DNSSEC key management process described in RFC 8078.
The aggregate nature of this chart means it reflects the behaviour of hundreds of TLDs combined, making it a useful high-level indicator of the industry's adoption of the CDS mechanism over time.
Return to CDS Daily Charts.
2. Mismatch between CDS and DS records
This chart shows the percentage of domains — among those that have both a DS record in the parent zone and a CDS record in the child zone — where the two do not match. A CDS record is an explicit declaration by a domain operator of what DS material they want published in the parent zone; if the parent zone does not reflect this, the domain's DNSSEC configuration is not in the state the operator intends. A persistent mismatch suggests that the registry or registrar responsible for processing CDS records is either not doing so, or is doing so infrequently. A brief or transient mismatch is expected, since registries typically process CDS changes on a schedule rather than instantly. This aggregate chart covers all observed TLDs, making it a broad measure of how well the DNS industry is acting on CDS signals.
Return to CDS Daily Charts.
3. Top TLDs With Signed Domains
This chart ranks the top 10 TLDs by the absolute number of domains that have at least one DS record in the parent zone. A DS record in the parent zone is the minimum requirement for a domain to be considered DNSSEC-signed from the perspective of a validator. The ranking is updated daily and reflects the raw count of signed domains, not a percentage. This makes it heavily influenced by the overall size of a TLD. The list tends to be stable over time, with changes most commonly caused by the addition of a large ccTLD to the observation project's data set. The top 10 TLDs from this chart are also the ones used for per-TLD breakdowns in the charts that follow.
Return to CDS Daily Charts.
4. Percentage of each TLD containing DS records
This chart shows, for each of the top 10 TLDs, what fraction of their total registered domains have at least one DS record in the parent zone. Unlike the previous chart which shows raw counts, this percentage normalises for TLD size, making it possible to compare how well different registries are serving or encouraging DNSSEC adoption among their registrants. A high percentage does not necessarily indicate a more technically engaged community of domain owners; it can reflect the policies, tooling, or defaults that a registry or registrar has chosen to implement.
Return to CDS Daily Charts.
5. Domains with DS records that also have CDS records. Per TLD
This chart breaks down CDS record presence on a per-TLD basis, showing the percentage of signed domains within each of the top 10 TLDs that also publish a CDS record. While the first chart aggregates this figure across all TLDs, this view reveals the considerable variation that exists between individual registries. Some TLDs have a very high proportion of their signed domains publishing CDS records, which tends to reflect a technically engaged registrant base, a registrar ecosystem that generates CDS records automatically, or both.
Return to CDS Daily Charts.
6. Mismatch between CDS and DS records. Per TLD
This chart shows the CDS-to-DS mismatch rate broken down per TLD, again limited to the top 10 TLDs by signed domain count. It is the per-TLD counterpart to chart 2 and is most useful when read alongside it. Where the aggregate chart can obscure the behaviour of individual registries, this chart makes it apparent when a specific TLD has a significantly higher or lower mismatch rate than its peers. A consistently elevated mismatch rate for a single TLD is unlikely to be explained by timing alone and is more likely to indicate a systemic failure in that registry's CDS processing pipeline. A TLD that suddenly sees a large drop in mismatch rate paired with a drop in signed domains may be shedding DS records rather than resolving the underlying inconsistency.
Return to CDS Daily Charts.
7. DNS Connection Error Rate. Per TLD
This chart shows the percentage of DNS queries that resulted in a connection error or timeout, broken down across the top 10 TLDs. These errors are recorded when a query fails to return a valid response, and do not include legitimate negative responses such as NXDOMAIN. The error rate is not purely a reflection of the quality of a TLD's authoritative nameservers; it is also influenced by the resolvers used during data collection and their capacity. That said, the error rate per TLD tends to be consistent from day to day, making sharp deviations worth noting. The scale on this chart is important context: most top 10 TLDs track well below a 5% error rate. If the error rate for a TLD climbs above 10% during a collection run, the processing for that TLD is aborted and retried, so sustained high values in this chart suggest repeated failures rather than a single bad run.
Return to CDS Daily Charts.