According to a recent survey conducted by the European Network and Information Security Agency (ENISA), 78% of service providers in Europe have plans to deploy DNSSEC within the next 3 years.
On the other hand, the study also found 22% have no plans to deploy DNSSEC in the next 3 years. The main reasons, according to those surveyed, are:
- Lack of customer demand for the service
- Cost of deployment and the on-going costs for running the service
- Immaturity of the technology
- Lack of requirement set to operators by National regulators
Additionally, service providers who are planning to deploy DNSSEC have expressed the following challenges as key barriers:
- Problems with the complexity of Key Management and Key Rollovers.
- Lack of supporting tools for Key Management as well as operational management of DNSSEC servers.
- Problems with increased system complexity of DNSSEC servers. In this respect, it has also been noted that in some cases equipment vendors deliver unstable products for DNSSEC support.
- Essential lack of key management policies as well as in a wider scope lack of information security policies with focus on DNSSEC and security management guidelines.
- Lack of end user awareness on the benefits provided by DNSSEC and the security it provides.
- There are no widely used applications that are supporting DNSSEC.
- The root of the DNS is not signed. This breaks the hierarchy of DNS and Trust Entry points (Trust anchors) have to be configured to the recursive resolvers.
- The distribution and update of the trust anchors is not standardised and there are no common policies and procedures yet in place.
- There is lack of standardisation in the transfer of the key material from the child domains to their parents.
- There is lack of tools notifying the user when the domain they are using is securely validated.
- The inherent feature of DNSSEC for authenticated denial of existence allows an abuser to enumerate the contents of a zone. The adoption of a variation of the protocol, named NSEC3, by the product vendors is required.
The full report can be downloaded here (PDF). Background information available here.
Related topics: DNSSEC, Security
