Pakistan's .pk now carries DNSSEC signing, but only one domain validates
in plain words
DNSSEC is a security system that lets computers check that a website address leads to the right place. Pakistan's .pk domain ending now uses it at the top level. But a scan found that only one domain under .pk has set it up fully.
Full summary
The .pk zone, which holds Pakistan's country-code domains, had no DNSSEC Domain Name System Security Extensions Digital signatures that prove DNS answers are genuine and unchanged. Full definition of DNSSEC in early October 2026. It had no DS record Delegation Signer A record in the parent zone that links a domain's DNSSEC key to the chain of trust. Full definition of DS record in the root and no signed proof when a name was missing. Six days later, the chain of trust The linked DNSSEC signatures from the root zone down to a domain. Full definition of chain of trust from the root down to .pk validated, so the zone had joined the signed part of the namespace The set of all names in one naming system, such as the DNS. Full definition of namespace.
Signing the top-level zone is only the first step. A scan of 158,561 .pk domains on 11 October, two days after the DS record appeared in the root, found exactly one domain that validates end to end. That domain is newspak.pk. Another 1,230 domains have signed their own zones but are waiting for a DS record that the .pk zone does not yet hold. None of the roughly 1,360 names under gov.pk and the provincial government suffixes is fully signed.
The timing can be traced from public sources. DNSViz showed .pk as insecure throughout September. The earliest signatures in the .pk zone date from 8 October, about a day before the root was updated. By 22:20 UTC on 9 October, DNSViz reported .pk as secure, and the IANA Internet Assigned Numbers Authority The functions that coordinate the root zone, IP addresses and protocol numbers. Full definition of IANA record for .pk shows a last update on the same day. The zone uses algorithm 13 (ECDSA P-256 with SHA-256) and NSEC and NSEC3 Next Secure and Next Secure version 3 DNSSEC records that prove a name or record does not exist. Full definition of NSEC and NSEC3 with no additional iterations and an empty salt, as RFC Request for Comments A numbered document in the series recording the internet's technical standards and practices. Full definition of RFC 9276 recommends.
The scan checked two parts of each chain. It queried the DS record held in the .pk zone and the DNSKEY record A DNS record holding a public key used to check a zone's DNSSEC signatures. Full definition of DNSKEY record held in the domain's own zone. A domain counted as fully signed only if the whole chain, from root to .pk to domain, validated. The 1,230 domains that sign their zones but lack a DS in the parent are treated as unsigned by validating resolver The DNS server that looks up domain names on behalf of users. Full definition of resolver, because the .pk zone returns a signed proof that no DS exists. They include accenture.pk and nexlinx.net.pk.
The rest of the scan found 117,572 names (74 percent) unsigned, 25,875 that no longer exist, and 13,883 that could not be classified because their nameservers were unreachable or timed out.
The gap between signing a zone and publishing its DS record is not new. A 2017 USENIX Security study of .com, .net, and .org found that roughly 30 percent of signed domains had no DS in the parent. Signing a zone and getting its DS into the parent are separate tasks, done by different parties, and the domain owner or DNS provider A company that runs the name servers for a domain, which may differ from the registrar. Full definition of DNS provider generates the signing keys. In the .pk case, names such as com.pk, org.pk, edu.pk, and gov.pk are part of the .pk zone itself, so every DS record for those names would be published by one organization.