Every ICANN-accredited registrar must support DNSSEC for its customers. The 2013 Registrar Accreditation Agreement requires registrars to accept DNSSEC data from registrants and pass it on to the registry. The agreement says nothing about the registrar’s own domain, the one that hosts its website, its control panel, and its login page. That domain is where a registrar’s own security choices become visible.

I measured those choices. In June 2025, I checked every ICANN-accredited registrar for a DS record on its primary domain. A DS record in the parent zone is what a validating resolver needs before it treats a domain as signed. Without it, any DNSSEC configuration on the registrar’s own name servers has no effect for the public.

The result is a baseline, not a verdict. Fewer than one in ten registrar domains is signed. Region explains more of the variation than registrar size does.

The Dataset

ICANN publishes the list of accredited registrars with the fields IANA ID, name, website URL, and Country/Territory. In June 2025, the list held 3,019 accreditations. One listed no public domain and was excluded. Many of the remaining 3,018 belong to the same operator. Drop-catching companies alone hold hundreds of accreditations under one roof.

I grouped accreditations by the registrable domain in the listed website URL. Each group became one registrar primary domain, represented by the accreditation with the lowest IANA ID. That left 698 distinct domains, 696 of them with a country entry that maps to one of six continents. Registrar size comes from ICANN’s monthly .com registry reports for 2024, averaged over the months in which an accreditation appears and summed per group.

For each domain, I queried the DS record set in the parent zone. A domain counts as signed when at least one DS record exists. I did not check whether the chain validates, which algorithms are in use, or whether the registrar’s name servers themselves run in signed zones. Those are separate questions.

What the Data Show

Four findings stand out.

First, 66 of the 698 registrar primary domains carry a DS record. That is 9.46%. Counted per accreditation instead of per domain, the rate drops to 2.32%, because the large multi-accreditation groups are unsigned. The choice of counting unit alone moves the headline figure by a factor of four.

Second, Europe is the outlier. Registrars with a European address signed 22.73% of their domains, 35 of 154. North America came to 7.45%, 19 of 255. Asia came to 3.46%, 9 of 260. Outside Europe, the combined rate is 5.72%, 31 of 542. A permutation test over all six regions and a two-sided Fisher test on Europe versus the rest both reject chance at p < 0.001. The odds ratio for Europe against the rest is 4.85.

Third, size matters less than it first appears. On its own, size is associated with signing. The median signed registrar manages 13,633 .com domains, the median unsigned one 1,888, and a Mann-Whitney test confirms the difference (one-sided p = 0.005). In a joint model with region, the size coefficient loses significance (p = 0.22), while region stays significant. Relative to Asian registrars, European ones have 7.6 times the odds of a signed domain after controlling for size. Larger registrars sign more often, at least in part because larger registrars are based in Europe.

Fourth, the long tail does not drive the result. The accredited list contains 83 registrar domains with no accreditation in any 2024 .com report and 111 with a .com size of zero. Excluding either group leaves the same pattern: a positive size association on its own, no size effect once region is in the model, and a European odds ratio between 6.6 and 8.1.

The chart above shows the regional split. The bars are rates, and the labels give the number of registrar domains behind each bar.

What the Data Do Not Show

Three limitations define what the numbers can support.

The measurement is a single snapshot from June 2025. It says nothing about the direction of travel. A registrar that enabled DNSSEC in July 2025 is counted as unsigned. A second snapshot will give a first reading on change over time.

The primary domain is a proxy. A registrar can sign its customer-facing domain and leave its EPP endpoint unsigned, or the other way round. A DS record also does not show who maintains the configuration; DNS hosting may sit with a provider. The Country/Territory field is the address the registrar declared to ICANN, not where its operations or its customers are. And the .com-based size measure understates registrars whose business sits in ccTLDs, which is more common in Europe and may itself contribute to the attenuation of the size effect.

The paper offers no causal claim about Europe. Region is a composite variable that bundles regulation, market structure and operational practice, and the study measures none of them separately. European ccTLD registries spent a decade pushing DNSSEC through incentives, tooling and registrar outreach, and that habit may have carried over to the registrars’ own domains. Or registrars outside Europe see DNSSEC as a customer feature rather than as part of their own security posture. The data fit both readings and cannot separate them.

Why Measure This at All

Registrars are the one group for which the “DNSSEC is hard” argument does not apply. They run the provisioning interfaces that push DS records to registries every day. They have the staff, the tooling, and the contractual knowledge. If 90% of them do not use that path for the single domain they control, the barrier is unlikely to be technical, and arguments about complexity deserve a second look for other groups too.

The measurement also gives the policy discussion a number. The RAA requires registrars to support DNSSEC for registrants. Whether a requirement for registrars’ own domains would be proportionate is a policy question that this study does not answer. It does establish what the status quo looks like before anyone proposes to change it.

The paper “A Data-Driven Analysis of DNSSEC Self-Deployment among ICANN-Accredited Registrars” is open access under CC BY in the International Journal of Information Management Data Insights (doi: 10.1016/j.jjimei.2026.100457). The dataset and analysis pipeline are on Zenodo (doi: 10.5281/zenodo.17260285, Version 3), and one command reproduces every reported figure without network access.