Ghana’s Domain Name System (DNS) security story presents an interesting contrast. APNIC Labs’ DNSSEC measurements report that approximately 99% of measured users in Ghana rely on DNSSEC-validating resolvers. Yet Ghana’s country-code top-level domain, .gh, remains unsigned.

This raises an important question: if DNSSEC validation capability is already so high, what should Ghana’s next priority be?

The answer lies in understanding the difference between the ability to validate DNSSEC and the deployment of DNSSEC across the domain infrastructure that users depend on. Ghana’s experience illustrates why Internet security progress cannot be assessed through a single measurement.

What Does 99% Actually Mean?

DNS is one of the Internet’s foundational services. It translates domain names into the IP addresses that computers use to communicate. Websites, email, digital public services, financial platforms, and many other online services depend on DNS functioning correctly.

DNS Security Extensions (DNSSEC) add cryptographic signatures to DNS data. These signatures allow validating resolvers to verify that DNS responses can be authenticated through the DNS chain of trust.

APNIC Labs’ DNSSEC measurements estimate the extent to which users rely on DNS resolvers that perform DNSSEC validation. Its country-level measurement for Ghana has been reported at approximately 99% for the period under discussion.

This is an encouraging indicator. However, it does not mean that 99% of Ghanaian domain names are DNSSEC-signed.

• A user may rely on a validating resolver while accessing a domain that has not been signed. In that case, the resolver cannot authenticate that domain’s DNS data using DNSSEC.
• Conversely, a domain may be correctly signed, but users accessing it through non-validating resolvers may not benefit from DNSSEC validation.

Research has repeatedly highlighted the difference between DNSSEC signing and validation. York (2023), writing for the Internet Society, explains that DNSSEC requires both domain operators to sign DNS data and resolvers to validate it. OECD’s policy analysis similarly identifies gaps in signing and validation rates as important obstacles to broader DNS security.

The measurement therefore tells us something about resolver capability, but it does not provide a complete picture of DNSSEC deployment across Ghana.

The DNSSEC Paradox: Validation Capability Without a Signed .Gh

Ghana’s DNSSEC story becomes more significant when the status of the .gh zone is considered.

The .gh country-code top-level domain is an important part of Ghana’s national domain infrastructure. When the .gh zone is unsigned, the DNSSEC chain of trust cannot be established through the .gh delegation to authenticate signed child domains beneath it through the normal DNSSEC hierarchy.

This means that even where a user’s resolver supports DNSSEC validation, that capability does not provide DNSSEC authentication for domains beneath the unsigned .gh zone through the normal chain of trust.

The contrast is not a contradiction in APNIC’s measurement. It reveals a difference between resolver-side validation capability and deployment at the domain namespace level.

The result is a useful policy and technical question: why should Ghana have high DNSSEC validation capability among measured users while its own country-code domain infrastructure remains unsigned?

This is not simply a matter of enabling a setting. Signing a top-level domain requires careful technical planning, operational readiness, key management, coordination with the parent zone and procedures for maintaining the DNSSEC chain of trust.

DNSSEC Adoption Is an Ecosystem Challenge

Peer-reviewed research has shown that DNSSEC deployment depends on more than the availability of the protocol.

Chung et al. (2017), in their study of DNSSEC adoption, found that registrars play a significant role in whether domain holders can successfully deploy DNSSEC. Their research identified barriers including limited registrar support, cumbersome implementation processes, and problems with the mechanisms used to communicate DNSSEC information.

This has implications for Ghana. DNSSEC adoption is not solely the responsibility of the organisation operating the .gh zone. It also involves registrars, domain holders, DNS hosting providers, Internet service providers and organisations managing critical online services.

A country may have validating resolvers, but if domain signing remains limited or operational support is weak, the overall security benefit is constrained.

The OECD’s 2022 report, Security of the Domain Name System (DNS): An Introduction for Policy Makers, emphasises the importance of stakeholder-led initiatives and incentives in improving DNSSEC adoption. Its analysis shows that countries with deliberate initiatives to encourage adoption have achieved stronger signing rates in their domain namespaces.

For Ghana, this suggests that DNSSEC should be treated as a coordinated infrastructure and governance issue rather than a purely technical configuration exercise.

DNSSEC Can Improve Security, but Poor Implementation Can Cause Outages

DNSSEC is designed to help protect the integrity of DNS data. It does not encrypt DNS queries, prevent all phishing attacks, guarantee website legitimacy, or protect against every form of cyberattack.

Its benefits also depend on correct implementation and ongoing maintenance.

Deccio (2012), in a peer-reviewed study published in the International Journal of Critical Infrastructure Protection, examined DNSSEC deployments and found that more than half of the zones studied experienced misconfigurations. The research also identified repeated problems and delays in correcting them.

The findings underline an important point: DNSSEC deployment can introduce operational complexity if signing, key management, delegation, and signature maintenance are not handled correctly.

For a country-code top-level domain, the consequences of operational failure can extend beyond a single organisation. Incorrect signatures or delegation information may cause validating resolvers to reject DNS responses, potentially making services unavailable to users.

Signing .gh should therefore be accompanied by careful testing, documented operational procedures, secure key management, monitoring and recovery planning.

The objective should not simply be to sign the zone. It should be to operate a reliable and maintainable DNSSEC deployment.

Four Priorities for Ghana

1. First, establish a clear DNSSEC deployment roadmap for .gh. Relevant stakeholders should publish a roadmap explaining the steps required to sign the .gh zone, including technical readiness, testing, operational responsibilities and an indicative implementation timeline. The process should be informed by established DNSSEC deployment guidance and operational best practices.
2. Second, develop a national DNSSEC deployment baseline. Ghana needs a clearer picture of DNSSEC deployment across its domain ecosystem. This should distinguish between the number of signed domains, resolver validation capability, availability of validating resolvers and adoption among critical public and private services. Reporting should clearly explain what each metric measures. A high validation rate should not be presented as evidence that most domains are signed.
3. Third, strengthen operational capacity and support. Registries, registrars, hosting providers, Internet service providers, and technical community organisations can support DNSSEC adoption through training, implementation guides, technical assistance, and testing resources. Smaller organisations may lack the staff and expertise to implement and maintain DNSSEC independently. Practical support and automation can reduce the burden and help prevent configuration errors.
4. Fourth, integrate DNS security into critical infrastructure governance. Public institutions, financial services, healthcare providers and other essential service organisations should understand their dependence on DNS. Cybersecurity reviews, supplier assessments and procurement processes should consider DNS integrity and availability, incident reporting, redundancy and recovery. DNSSEC should be considered alongside other protective measures, including secure configuration, monitoring, access controls and incident response.

From a Validation Statistic to National Infrastructure Policy

Ghana’s reported DNSSEC validation capability is a positive indicator. But the unsigned .gh zone shows why the country needs a more complete understanding of DNS security.

The next step is not simply to celebrate a high percentage. It is to establish where DNSSEC is deployed, how reliably it is maintained and what barriers prevent wider adoption.

The country’s domain infrastructure is part of the foundation on which digital services depend. Its security and resilience require collaboration among technical operators, policymakers, regulators, domain industry participants and the wider Internet community.

DNSSEC is not a complete cybersecurity solution. It is, however, an important mechanism for protecting the integrity of DNS data when correctly deployed and validated.

Ghana has an opportunity to build on its high validation capability by addressing the deployment gap at the .gh level, supporting domain operators and making DNS security a measurable part of Internet infrastructure governance.

If 99% can validate, the next question is whether Ghana’s domains and DNS operators are ready to make that capability count.

References

Chung, T., van Rijswijk, R. M., Choffnes, D., Levin, D., Maggs, B., Mislove, A., & Wilson, C. (2017). Understanding the role of registrars in DNSSEC deployment. Proceedings of the 2017 Internet Measurement Conference, 369—383.

Deccio, C. (2012). Maintenance, mishaps and mending in deployments of the domain name system security extensions (DNSSEC). International Journal of Critical Infrastructure Protection, 5(2), 98—103.

OECD. (2022). Security of the Domain Name System (DNS): An Introduction for Policy Makers.

Rose, S., Liu, C., & Gibson, R. (2026). Secure Domain Name System (DNS) Deployment Guide. National Institute of Standards and Technology, SP 800-81 Rev. 3.

York, D. (2023, March 16). DNSSEC validation in 2022: Africa leads with amazing growth. Internet Society Pulse.

APNIC Labs. DNSSEC Validation Capability Metrics.