The State of DNSSEC - Korea

DNSSEC adoption in Korea is near zero. Out of 131,024 live .kr domains, only 118 are signed.

Meanwhile, APNIC Labs reports that just 3.15% of Korean internet users sit behind resolvers that validate signatures, compared to 39.41% globally.

DNSSEC allows domain owners to cryptographically sign DNS records so resolvers can reject forged responses, preventing DNS spoofing attacks that redirect visitors to malicious servers. Below, we outline how we tested DNSSEC prevalence in Korea and examine three signed domains that currently fail to resolve for validating users.

Signing: 118 of 131,024

We evaluated 217,129 .kr domains and filtered for the 131,024 live domains that responded without timing out or returning lookup errors.

This sample is a subset of overall registrations. KRNIC recorded 1,104,883 .kr registrations in August 2026.

On September 23, 2026, we queried 1.1.1.1 and 8.8.8.8 for each domain's DS record in the .kr zone. The parent zone uses the DS record to vouch for a child zone's signing key; without it, a domain remains unsigned.

Only 118 domains returned a DS record. That's a staggering 0.09% of the live domains sampled.

Of those 118, the .kr registry operates 20 directly: 16 regional zones (such as seoul.kr), plus ai.kr, io.kr, it.kr, and me.kr. That leaves only 98 third-party signed domains.

The registry infrastructure has been ready for over a decade. KRNIC signed .kr in 2011 and completed signing all 31 Korean country-code zones by September 2012, enabling any .kr domain to implement DNSSEC.

Nevertheless, for some reason, other domain registries report significantly higher adoption rates among total registrations:

• .nl: 59.74% (3,710,347 of 6,210,594 domains on September 24, 2026, per SIDN Labs).
• .cz: 66.79% (1,012,492 of 1,515,860 domains at year-end 2025, per the CZ.NIC Domain Report 2025).
• .com and .net combined: ~5%. (Verisign's DNSSEC Scoreboard listed 8,939,167 signed domains on September 22, 2026, against roughly 179.1 million registrations reported in its Q2 2026 Domain Name Industry Brief).

Validation: About 3% of Users

A DNSSEC signature provides no protection unless the user's resolver checks it. APNIC Labs measures validation using online ads that trigger browsers to request hostnames with deliberately broken signatures. Resolvers that refuse the broken name are classified as validating.

In Korea, only 3.15% of users validate signatures, compared to 39.41% worldwide.

An additional 2.30% of Korean users show partial validation, which typically occurs when a primary resolver fails over to an unvalidating secondary resolver. Because this fallback still loads forged names, we count only full validation.

APNIC breaks down 30-day average validation rates across Korean network providers:

Sample volumes reflect ad distribution patterns rather than ISP market share, so treat these figures as indicative. SK Broadband is an outlier with the smallest sample size.

Three Signed Domains That Fail

On September 26, 2026, we ran delv against all 121 signed domains identified in our research (the 118 live signed domains plus 3 previously set aside due to lookup failures). delv verifies the cryptographic chain of trust starting from the root key.

While 117 domains validated successfully and 1 no longer exists, 3 failed validation, causing 8.8.8.8 to return SERVFAIL errors:

;; validating example-one.co.kr/SOA: no valid signature found
;; insecurity proof failed resolving 'example-two.co.kr/SOA/IN': 1.1.1.1#53

For users behind validating resolvers, these three domains are completely unreachable.

One broken domain uses Gabia nameservers. Gabia's documentation states: "가비아 네임서버는 DNSSEC을 지원하지 않습니다" ("Gabia nameservers do not support DNSSEC").

Publishing a DS record at the parent zone while hosting DNS on an unsigned nameserver creates this exact failure.

Because only ~3% of Korean users validate DNSSEC, domain owners with broken signatures rarely hear about the issue from local visitors.

Check Your Own Domain

First, query the parent zone for your domain's DS record:

dig +short DS yourcompany.co.kr

An empty output means the domain is unsigned. A line of numbers followed by a hexadecimal string indicates an active DS record.

Next, test the full validation chain:

delv yourcompany.co.kr SOA

• ; fully validated confirms valid signatures.
• ; unsigned answer indicates DNSSEC is inactive.
• no valid signature found or insecurity proof failed signals a signed but misconfigured domain, like the three failing examples above.

You submit DS records through your registrar. Gabia only allows DS submissions for domains hosted on external nameservers, and .kr DS submissions require a KISA review that takes 1–2 days. Hosting.kr processes DS records exclusively via 1:1 support inquiries.

---

We are curious: has your registrar or DNS host ever offered to enable DNSSEC for your domain?

References

1. KRNIC — 국가도메인 등록 현황 (national domain registration statistics; 1,104,883 .kr registrations, August 2026)
2. KRNIC — DNSSEC이란? (what is DNSSEC; .kr signed from 2011, all 31 zones by September 2012)
3. SIDN Labs — .nl statistics: DNSSEC (retrieved 2026-09-24)
4. CZ.NIC — Domain Report 2025 (published 2026-02-17)
5. Verisign — DNSSEC Scoreboard (retrieved 2026-09-22)
6. Verisign / DNIB.com — DNIB.com Reports Internet Has 401.6 Million Domain Name Registrations at the End of the Second Quarter of 2026 (2026-07-23; .com and .net combined: 179.1 million)
7. APNIC Labs — Use of DNSSEC Validation for Republic of Korea (KR) (retrieved 2026-09-26)
8. Geoff Huston — How we measure: DNSSEC validation (APNIC Blog, 2023-10-31)
9. Gabia customer center — domain manual: DNSSEC
10. Hosting.kr help center — DNSSEC DS record registration