Why Top-Level Domain Operators Can No Longer Rely on Hope for DNSSEC

Open source software is often the unglamorous workhorse in the server rack, the silent operator in the stack, and the rebellious soul in the operations pipeline. It is thoroughly tested and trusted for good reasons, but when a business or a critical registry depends on it, relying on the goodwill of volunteers is not enough. Alex Band, Director of Product Development at NLnet Labs, said that enterprise-grade support from the people who wrote the code means you are not gambling your business on the generosity of volunteers; you are paying for reliability, continuous improvements, and a real person to call when things go wrong. That accountability is exactly what many organisations lack today.

The idea that open source is free is misleading. It is free the way a stray dog is free: you can take it home, but you must feed it, train it, and rush it to the vet when it swallows something it should not. In today's regulatory climate, compliance adds another layer. NIS2, the EU directive on network and information security, brings stricter obligations around DNS infrastructure, incident handling, and supply chain resilience across the European Union. For any organisation running DNS services, stability, security, and accountability are no longer optional.

One of the quiet cornerstones of this world is DNSSEC, short for Domain Name System Security Extensions. DNSSEC adds digital signatures to DNS records so that devices can verify that an answer has not been tampered with. Signing zones, managing key lifecycles, and keeping trust chains intact are meticulous, ongoing tasks. When DNSSEC fails, the result can be outages, lost trust, and serious reputational damage.

To understand what keeps operators awake at night, NLnet Labs asked 16 top-level domain (TLD) operators what worries them most. Their answers reveal clear gaps. Trust, continuity, and compliance are now baseline concerns, but many operators still build infrastructure around individual heroics rather than auditable processes that can be transferred and trusted beyond any single person. Uptime alone is no longer enough: operators want resilience, observability, accountability, and a documented chain of recovery. Support models are also inconsistent. About 50 percent of surveyed TLDs have formal service level agreements or contracts for support, while roughly 35 percent said they have someone they can call, and around 15 percent are completely on their own if something breaks.

The survey also found that observability, validation, and auditable pipelines are often missing. Many TLDs use manual validation tools like DNSViz or internal scripts, and few have full, automated, built-in visibility between every stage of the signing process. As a result, they often do not know something is wrong until after damage has been done. Recovery and fallback plans are also spotty. Although every TLD operator agrees that failure is inevitable, many said their fallback strategies are unclear, undocumented, or depend on tribal knowledge held by a single person.

These findings drove the design of Cascade, a new open source DNSSEC signer built by NLnet Labs on feedback from those 16 leading TLDs. Legacy systems are no longer cutting it. Operators are tired of failed cron jobs, which are scheduled automated tasks that silently break, and brittle XML configuration files. Auditors are even less forgiving: they demand full visibility, traceability, and processes that can be proven under pressure. Cascade is not a silver bullet, but it represents what happens when open source meets professional-grade engineering and real-world support. It gives teams the pros on their side when auditors come with tough questions.

The bottom line is that if DNSSEC is part of your critical path, signing zones, managing key lifecycles, or keeping trust chains intact for millions of users, you cannot rely on outdated tools, cowboy coding, or hero ops. You need open source tooling built for today's corporate reality, with enterprise support that understands the weight of what you are protecting. NLnet Labs also offers help migrating from your current system to Cascade end to end. That is how you build trust and sleep at night.

Cascade officially launches on October 7th at OARC 45 in Stockholm. Organisations interested in support options can contact Alex Band at NLnet Labs. For everyday internet users and website owners, this is a reminder that DNSSEC is only effective if your resolver checks it. Using a privacy-first encrypted DNS service such as AEU DNS adds another layer of protection because it validates DNSSEC signatures on your behalf, rejecting answers that have been tampered with.