With such a big web security hole, why is DNSSEC not used everywhere already?
The reason for the delay in DNSSEC deployment has to do with education, speed, and cost. First, not enough people were convinced DNSSEC was even necessary. The problem of the giant security hole was only made understandable recently by Internet security researcher Dan Kaminsky, who publicized just how huge the problem to the Internet was. Second, the cryptography of signing DNS records requires more bandwidth, because DNSSEC records are quite large compared to other DNS records. For infrastructure providers, such as the top level registries and large ISPs, DNSSEC deployment is a huge undertaking. Finally, there’s also a “demand” problem with DNSSEC deployment. Many people are not aware of the DNS, let alone this specific problem.
