Typing an address in your browser’s address bar should take you to the site you’re looking for. DNSSEC is a technology that guarantees the naming part of this process. It prevents third parties from secretly redirecting visitors to different or even malicious sites. An up-to-date implementation of this technology is required to trust government domains.
We measured DNSSEC implementations on 48,000 government domains in 31 European countries and found that adoption by country ranges from zero to one hundred percent. All higher adoption rates are directly associated with government policies and promotions by domain name registries.
Adoption in itself does not make implementations secure. As DNSSEC is a cryptographic standard, it requires periodic maintenance to stay resilient as computing power increases. We see the need to maintain DNSSEC implementations in nearly all countries. While some governments regularly publish guidelines on keeping cryptography up to date, DNSSEC is not mentioned.
Adoption and security
We’ve investigated the adoption rate and implementation security of governmental DNSSEC, resulting in two graphs.
The first graph shows DNSSEC adoption by country, ranging from 100% in the Netherlands to 0% in Cyprus, Ireland, Liechtenstein, and Malta. There are six regions where the majority of governmental domains use DNSSEC: the Netherlands, Sweden, Denmark, Czechia, Norway, and all European governmental Computer Security Emergency Response Teams (CSIRTs).
We’ve used the tool Zonemaster to measure the strength of each of these DNSSEC implementations. It can identify about 120 failure scenarios, which are classified into four risk categories. Read more about these categories and our measurement policy in our April 2026 article. We’ve color-coded these categories like a traffic light, from red, meaning high risk, to dark green, meaning a secure implementation.
When we order the countries by number of secure implementations, we see that the graph is thoroughly reshuffled. Only Sweden and Norway have correctly secured the majority of their implementations. Other top performers rank lower but remain near the top, mostly because other countries have insignificant adoption rates. France is especially interesting, as nearly all of its DNSSEC implementations are out of date.
On our website, securitybaseline.eu, we publish up to date results of these metrics every two days. We present them on geographical maps using the same color coding. If we take three of the best best performers, it appears that DNSSEC is managed in clusters. Both the Dutch and Swedish maps show clusters of red, orange and dark green.
Biggest culprit: short RSA keys
Short RSA keys account for most high-risk findings. The length of a cryptographic key needs to extend as computing power grows. Our current tests use a minimum RSA key length of 2028 bits, a recommendation from the 2016 NIST standard, which might still be too short. The 2025 Dutch governmental standard for Transport Layer Security recommends RSA key lengths of 3072 bits or longer.
Computers can try different keys at blazingly fast speeds. Keys such as in the examples below, with five of twentyfive bits, can be tested in an instant and are thus not secure.
In France short key lengths are the reason over 90% of DNSSEC implementations are insecure. The situation in France specifically might be related to a promotional scheme of the domain name registrar, which ended at the end of 2013: these configurrations have since never been updated and use key lengths that where state of the art back then. The below graph shows the percentage of key length being the main culprit of insecure DNSSEC implementations per country.
Policies and promotion drive adoption
We found a direct correlation between implementation incentives and adoption. Nine of the eleven highest adopters have a governmental DNSSEC policy, a registry promotion scheme, or both. The two other regions: CSIRTs and Belgium have different reasons why they are in the top eleven.
| Country | Adoption | Secure adoption | Incentives |
|---|---|---|---|
| Netherlands | 100% | 34.26% | Governmental, Registrar |
| Sweden | 87.21% | 54.21% | Governmental, Registrar |
| Denmark | 85.00% | 27.78% | Governmental, Registrar |
| Czechia | 83.72% | 28.78% | Governmental, Registrar |
| Norway | 76.98% | 52.38% | Governmental, Registrar |
| Euopean CSIRTs | 56.06% | 33.33% | CSIRT responsibility |
| Bulgaria | 40.34% | 24.75% | Governmental |
| Switzerland | 34.19% | 28.32% | Registrar |
| Slovakia | 30.77% | 15.38% | Governmental, Registrar |
| Belgium | 30.10% | 7.89% | Web-security-map |
| Estonia | 26.19% | 26.19% | Governmental |
CSIRTs are responsible for handling cybersecurity incidents at the national level. This means that they must be aware of DNSSEC. Every European country positions their CSIRT-website and services somewhere else: some place them under the top level domain of the government, others have a dedicated domain. To level the playing field, we associate each CSIRT with the most important government domain in each country. You can look at the CSIRT map on securitybaseline.eu and see that some CSIRTs do not apply DNSSEC on their own domain as well.
Belgium is the other outlier with 30.10% adoption, just slightly above Estonia’s 26.19%. We’ve seen that Belgium has implemented DNSSEC at 20 municipalities after the introduction of our Belgian site basisbeveiliging.be in early 2025. Otherwise their adoption rate would be 26.80%, (still) margininally higher than Estonia.
Governmental guidelines and mandates
There are nine European governments that have adopted DNSSEC into their policies. All of them are top performers, except for Germany.
| Country | Policy Scope | Law, Policy and/or Document name | Adoption | Secure |
|---|---|---|---|---|
| Bulgaria | Gov. sites | НАРЕДБА ЗА ЕЛЕКТРОННИТЕ АДМИНИСТРАТИВНИ УСЛУГИ | 40.34% | 24.75% |
| Czechia | Gov. sites | Usnesení vlády ze dne 17. ledna 2024 č. 49 | 83.72% | 28.78% |
| Denmark | Gov. sites | DE TEKNISKE MINIMUMSKRAV FOR STATSLIGE MYNDIGHEDER 2024 | 85.00% | 27.78% |
| Estonia | Gov. sites | E-ITS / Eesti infoturbestandard | 26.19% | 26.19% |
| Germany | Portals | Technische Richtlinie TR-03172-3 Portalverbund | 2.98% | 1.48% |
| Netherlands | Gov. sites | “Pas toe of leg uit” Forum Standaardisatie | 100.00% | 34.26% |
| Norway | Gov. sites | Grunnleggande datakommunikasjon | 76,98% | 52.38% |
| Slovakia | Gov. sites | Metodika pre systematické zabezpečenie organizácií verejnej správy v oblasti informačnej bezpečnosti | 30.77% | 15.38% |
| Sweden | Gov. sites | MSBFS 2020:7, 11 September 2020 | 87.21% | 54.21% |
The German policy is specific and targets online portals. The law describes a portal as any online place where a citizen can perform a governmental procedure. General information and communication such as contact forms and live chats are not in scope.
The specific law makes it hard to measure its effectiveness, as outsiders need to know what websites are portals. Determining this requires the ability to know all German governmental websites, distinguishing portals from non-portals by understanding all flows on these sites and being a native speaker. This is hard and still leaves the large majority of government domains vulnerable.
It requires little effort to pinpoint portals that do not apply DNSSEC, or to finding non-portals that apply DNSSEC. There seems to be no line. Below are three screenshots of German governmental portals without DNSSEC protection:
During writing of this article the new German Grundschutz++ was presented, we have not investigated this new policy.
Domain name registry promotions and discounts
Domain ownership is managed at domain name registrars. These registrars can promote the use of a certain standard in various ways, such as recognition and discounts. We found nine promotion schemes, of which six are still active. There are no registries that block domains without DNSSEC.
While Liechtenstein also falls under an active promotion, adoption remains at 0% even though the country shares the same registry as Switzerland.
| Country | Status | Supporting evidence | Adoption | Secure |
|---|---|---|---|---|
| Czechia | Historical | RIPE presentation, slide 7 | 83.72% | 28.78% |
| Denmark | Active | punktum.dk | 85.00% | 27.78% |
| France | Historical | afnic.fr, till 2013 | 20.16% | 0.82% |
| Latvia | Active | nic.lv, up to 50% discount | 11.32% | 3.77% |
| Switzerland / Liechtenstein | Active | nic.ch, till end of 2026 | 34.19% / 0% | 28.32% / 0% |
| Netherlands | Active | sidn.nl, indirectly via Register Scorecard | 100.00% | 34.26% |
| Norway | Historical | norid.no | 76.98% | 52.38% |
| Slovakia | Active | sk-nic.sk | 30.77% | 15.38% |
| Sweden | Active | internetstiftelsen.se | 87.21% | 54.21% |
Wrapping up
Most European citizens are currently not protected against a set of well known cyberattacks such as DNS spoofing and cache poisoning. The capabilities to do so are already developed, tried and tested. We urge all Europrean governments to adopt DNSSEC into their policies, mandating it’s implementation on all governmental websites and include maintenance.
In this process, governments should colaborate with each other, as Internet comes without borders: cryptographic strength means the same everywhere. There are no country-level recommendations for DNSSEC yet. Adopting an up-to-date cryptography policy tested with tools such as Zonemaster or Gonemaster tools would be a great starting point.
About these measurements
In May 2026, the Internet Cleanup Foundation launched Security Baseline, a free and open initiative that creates transparency on the digital security of all European regional governments and each country’s CSIRT. In April 2026, we upgraded our DNSSEC measurements to use Zonemaster from the Swedish domain registry, validating DNSSEC on 120 characteristics. This article combines these two milestones. We perform daily measurements of DNSSEC and other cyber security standards, all metrics and reports are publicly available at securitybaseline.eu.
Only second-level domains are tested, such as amsterdam.nl and berlin.de. Our tests did not follow redirects.
The Internet Cleanup Foundation is a not-for-profit membership organization that strengthens the internet by making it more transparent. Find out more about the foundation at https://internetcleanup.foundation. We measure over 500.000 domains on baseline security requirements and 70.000 on baseline accessibility requirements; all results are publicly available as open data. All of our articles are written by hand and might contain “Dutchisms” as we’re not native speakers.
Raw data
Data from 2026-09-11 (ISO 8601)
| Country Code | Name | High | Medium | Low | Ok | Signed Domains | Unsigned domains | Smaller than recommended keysize (for DNSSEC enabled) |
| AT | Austria | 6.85% | 0.00% | 0.45% | 1.96% | 9.26% | 90.74% | 70.91% |
| BE | Belgium | 10.69% | 0.49% | 11.02% | 7.89% | 30.10% | 69.90% | 24.59% |
| BG | Bulgaria | 13.22% | 0.34% | 2.03% | 24.75% | 40.34% | 59.66% | 11.76% |
| CH | Switzerland | 2.72% | 0.14% | 3.01% | 28.32% | 34.19% | 65.81% | 7.28% |
| CY | Cyprus | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 100.00% | 0.00% |
| CZ | Czechia | 39.63% | 2.99% | 12.32% | 28.78% | 83.72% | 16.28% | 42.34% |
| DE | Germany | 0.92% | 0.01% | 0.57% | 1.48% | 2.98% | 97.02% | 24.65% |
| DK | Denmark | 4.44% | 0.56% | 52.22% | 27.78% | 85.00% | 15.00% | 1.96% |
| EE | Estonia | 0.00% | 0.00% | 0.00% | 26.19% | 26.19% | 73.81% | 0.00% |
| ES | Spain | 1.03% | 1.03% | 1.03% | 1.03% | 4.12% | 95.88% | 25.00% |
| EU | Europe | 7.58% | 3.03% | 12.12% | 33.33% | 56.06% | 43.94% | 8.11% |
| FI | Finland | 0.89% | 0.30% | 2.08% | 6.55% | 9.82% | 90.18% | 3.03% |
| FR | France | 18.85% | 0.12% | 0.38% | 0.82% | 20.16% | 79.84% | 91.52% |
| GR | Greece | 1.06% | 0.00% | 0.00% | 1.06% | 2.12% | 97.88% | 25.00% |
| HR | Croatia | 1.17% | 0.00% | 0.00% | 1.40% | 2.56% | 97.44% | 27.27% |
| HU | Hungary | 14.04% | 0.00% | 0.87% | 6.00% | 20.91% | 79.09% | 53.22% |
| IE | Ireland | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 100.00% | 0.00% |
| IS | Iceland | 0.00% | 0.00% | 0.00% | 3.08% | 3.08% | 96.92% | 0.00% |
| IT | Italy | 0.11% | 0.11% | 0.11% | 0.98% | 1.30% | 98.70% | 0.00% |
| LI | Liechtenstein | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 100.00% | 0.00% |
| LT | Lithuania | 1.52% | 0.00% | 0.00% | 0.00% | 1.52% | 98.48% | 0.00% |
| LU | Luxembourg | 5.00% | 0.00% | 1.00% | 0.00% | 6.00% | 94.00% | 66.67% |
| LV | Latvia | 3.77% | 0.00% | 3.77% | 3.77% | 11.32% | 88.68% | 0.00% |
| MT | Malta | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% | 100.00% | 0.00% |
| NL | Netherlands | 23.68% | 7.80% | 34.26% | 34.26% | 100.00% | 0.00% | 23.40% |
| NO | Norway | 14.81% | 0.00% | 9.79% | 52.38% | 76.98% | 23.02% | 6.19% |
| PL | Poland | 5.80% | 0.18% | 8.75% | 0.50% | 15.24% | 84.76% | 32.14% |
| PT | Portugal | 7.57% | 1.89% | 1.89% | 3.79% | 15.14% | 84.86% | 37.50% |
| RO | Romania | 2.38% | 0.00% | 0.00% | 2.38% | 4.76% | 95.24% | 0.00% |
| SE | Sweden | 12.12% | 5.72% | 15.15% | 54.21% | 87.21% | 12.79% | 8.49% |
| SI | Slovenia | 3.37% | 0.00% | 0.00% | 0.00% | 3.37% | 96.63% | 42.86% |
| SK | Slovakia | 0.00% | 0.00% | 15.38% | 15.38% | 30.77% | 69.23% | 0.00% |
| Country Code | Name | Domains | High | Medium | Low | Ok | Signed domains | Signed domains w/ smaller than recommended keysize |
| AT | Austria | 1782 | 122 | 0 | 8 | 35 | 165 | 117 |
| BE | Belgium | 608 | 65 | 3 | 67 | 48 | 183 | 45 |
| BG | Bulgaria | 295 | 39 | 1 | 6 | 73 | 119 | 14 |
| CH | Switzerland | 2129 | 58 | 3 | 64 | 603 | 728 | 53 |
| CY | Cyprus | 5 | 0 | 0 | 0 | 0 | 0 | 0 |
| CZ | Czechia | 6094 | 2415 | 182 | 751 | 1754 | 5102 | 2160 |
| DE | Germany | 9542 | 88 | 1 | 54 | 141 | 284 | 70 |
| DK | Denmark | 180 | 8 | 1 | 94 | 50 | 153 | 3 |
| EE | Estonia | 42 | 0 | 0 | 0 | 11 | 11 | 0 |
| ES | Spain | 97 | 1 | 1 | 1 | 1 | 4 | 1 |
| EU | Europe | 66 | 5 | 2 | 8 | 22 | 37 | 3 |
| FI | Finland | 336 | 3 | 1 | 7 | 22 | 33 | 1 |
| FR | France | 19001 | 3581 | 22 | 72 | 156 | 3831 | 3506 |
| GR | Greece | 378 | 4 | 0 | 0 | 4 | 8 | 2 |
| HR | Croatia | 429 | 5 | 0 | 0 | 6 | 11 | 3 |
| HU | Hungary | 2750 | 386 | 0 | 24 | 165 | 575 | 306 |
| IE | Ireland | 35 | 0 | 0 | 0 | 0 | 0 | 0 |
| IS | Iceland | 65 | 0 | 0 | 0 | 2 | 2 | 0 |
| IT | Italy | 922 | 1 | 1 | 1 | 9 | 12 | 0 |
| LI | Liechtenstein | 11 | 0 | 0 | 0 | 0 | 0 | 0 |
| LT | Lithuania | 66 | 1 | 0 | 0 | 0 | 1 | 0 |
| LU | Luxembourg | 100 | 5 | 0 | 1 | 0 | 6 | 4 |
| LV | Latvia | 53 | 2 | 0 | 2 | 2 | 6 | 0 |
| MT | Malta | 21 | 0 | 0 | 0 | 0 | 0 | 0 |
| NL | Netherlands | 359 | 85 | 28 | 123 | 123 | 359 | 84 |
| NO | Norway | 378 | 56 | 0 | 37 | 198 | 291 | 18 |
| PL | Poland | 2205 | 128 | 4 | 193 | 11 | 336 | 108 |
| PT | Portugal | 317 | 24 | 6 | 6 | 12 | 48 | 18 |
| RO | Romania | 42 | 1 | 0 | 0 | 1 | 2 | 0 |
| SE | Sweden | 297 | 36 | 17 | 45 | 161 | 259 | 22 |
| SI | Slovenia | 208 | 7 | 0 | 0 | 0 | 7 | 3 |
| SK | Slovakia | 13 | 0 | 0 | 2 | 2 | 4 | 0 |
