Managing Mission - Critical Domains and DNS

Operational ramifications of DNSSEC

While most operational TLDs today are DNSSEC-signed, enough of them still aren't to have to make it a point to ensure that your zone's parent domain (TLD) is itself DNSSEC-signed. The following table lists all the TLDs, which at the time of writing are not DNSSEC-enabled. If you want to sign a domain under one of these TLDs, you cannot successfully create a chain-of-trust:

ae	aero	ai	al	ao	aq	as	ba	bb	bd
bf	bh	bi	bj	bn	bo	bs	bv	cd	cf
cg	ch	chart	ci	ck	cm	cu	cv	cw	cy
dj	dm	do	dz	ec	eg	er	et	fj	fk
ga	gb	ge	gf	gg	gh	gm	gp	gq	gt
gu	gy	hm	ht	im	iq	ir	je	jm	jo
kh	km	kn	kp	kw	kz	ls	ly	mc	mh
mk	ml	mo	mp	mq	ms	mt	mu	mv	mw
mz	ne	ng	ni	np	nr	pa	pf	pg
ph	pk	pn	ps	py	qa	rs	rw	sd	sk
sm	so	sr