Frank, You do list two of the common concerns I hear about DNSSEC. The good news is that we're increasingly seeing better tools that help, for instance, automate the rolling of keys and thereby minimizing some of the mistakes. And some of the DNS hosting operators have improved the user experience. For instance, with two of my domains I just basically had to check a box in a web user interface and the hosting provider takes care of it. However, you do need to consider in your operational practices that you do need to roll keys on some interval and factor that into your planning. On your second issue about registrars, this unfortunately does remain a problem. An increasingly number of registrars are supporting DNSSEC, but a good number still do not. I had to go through the annoyance of moving several domains away from a registrar that just wouldn't provide a way for me to enter in the DS record I had from my hosting operator. Hopefully the registrar situation will improve over time as: 1) more customers request the support; and 2) competitive pressures start to kick in as more registrars do support it.

The 2013 RAA only requires registrars to "accept DNSSEC records" from customers, and specifically to accept a DS record from a customer. Keep in mind that what we often think about as "DNSSEC support" is really two distinct and separate functions: 1. a "registrar" function of accepting a DS record and passing it up to the parent domain (typically a TLD) to create the global chain of trust; and 2. a "DNS hosting" function that for DNSSEC involves generating the keys, signing the zones, etc. Now, MANY "registrars" offer BOTH services. They will register your domain and accept the DS records and pass them up to the parent domain - AND they will host your DNS records for you and do all the DNSSEC-signing. But... they could be completely separate. You could register your domain with one registrar and host your DNS records with a different company. The 2013 RAA only requires registrars to perform this registrar function of accepting DS records and passing them up to the parent domain. The RAA does NOT require the DNS hosting side of a registrar to do DNSSEC-signing.

For their customers, they might support both functions 1 and 2 outlined above. However, it would be nice if they also signed their own domains. For example, consider the gkg.net registrar, where you can purchase domains in many of the tlds. dig gkg.net ds They are one of the few that have signed their own domain.

APNIC's statistics on DNSSEC are interesting, but it is unclear to me exactly what they are measuring. One is the percentage of queries that are arriving from validating resolvers such as Google. Geoff Huston published measurements in 2013 from some experiments. Those involved getting a wide selection of clients to make queries to names in zones that he controlled. That measures the extent of the validation infrastructure deployment. Another is the percentage of signed vs unsigned zones in some upper level like .com or .nl. But this measurement may be biased by including a large number of signed zones for vanity domains, where there are essentially no queries. This could also be biased by some large domain registrar that automatically signs all their zones. I don't know if any of them do this, but it would be possible for a registrar to generate signatures for all the domains where the customer has not changed the registrar default NS records. In that case, the registrar is responsible for the NS records. They might just take on the responsibility for the DS records as well, possibly in response to a checked-by-default checkbox associated with an increased fee. This could be sold to the customer as a security upgrade for their domain name. Another is the percentage of queries (from any source) for names in a signed zone. One could measure that by analyzing all the incoming queries to some large recursive resolvers such as Google or Comcast. I think this is the measurement of interest to see the extent of the DNSSEC signing deployment.