---
id: "624cdceb-3fde-414f-bf4b-39dfd64f4c5a"
kind: "link"
title: "Pakistan's .pk now carries DNSSEC signing, but only one domain validates"
language: "en"
section: "cctld"
date: "2026-10-20T17:27:21Z"
updated: "2026-10-20T17:27:21Z"
canonical: "https://tldlog.com/l/pakistans-pk-now-carries-dnssec-signing-only-one-domain/"
origin: "master"
translations:
  es: "https://tldlog.com/es/l/pakistan-activa-firma-zona-pk-solo-dominio-valida/"
  de: "https://tldlog.com/de/l/pakistans-pk-erhaelt-dnssec-signierung-aber-nur-domain/"
  fr: "https://tldlog.com/fr/l/pk-pakistan-adopte-signature-zone-dnssec-seul-domaine-est/"
  it: "https://tldlog.com/it/l/pk-ora-ha-firma-zona-dnssec-solo-dominio-validato/"
  pt-BR: "https://tldlog.com/pt/l/zona-pk-paquistao-agora-tem-assinatura-zona-so-dominio/"
  ru: "https://tldlog.com/ru/l/zona-pk-pakistane-poluchila-podpisanie-zony-proverku/"
  zh-Hans: "https://tldlog.com/zh/l/bajisitan-pk-qiyong-dnssec-qianming/"
source:
  name: "circleid.com"
  url: "https://circleid.com/posts/pakistans-.pk-is-now-dnssec-signed-but-only-one-domain-validates"
  language: "en"
  date: "2026-10-20T15:23:00Z"
---

# Pakistan's .pk now carries DNSSEC signing, but only one domain validates

## in plain words

DNSSEC is a security system that lets computers check that a website address leads to the right place. Pakistan's .pk domain ending now uses it at the top level. But a scan found that only one domain under .pk has set it up fully.

The .pk zone, which holds Pakistan's country-code domains, had no DNSSEC in early October 2026. It had no DS record in the root and no signed proof when a name was missing. Six days later, the chain of trust from the root down to .pk validated, so the zone had joined the signed part of the namespace.

Signing the top-level zone is only the first step. A scan of 158,561 .pk domains on 11 October, two days after the DS record appeared in the root, found exactly one domain that validates end to end. That domain is newspak.pk. Another 1,230 domains have signed their own zones but are waiting for a DS record that the .pk zone does not yet hold. None of the roughly 1,360 names under gov.pk and the provincial government suffixes is fully signed.

The timing can be traced from public sources. DNSViz showed .pk as insecure throughout September. The earliest signatures in the .pk zone date from 8 October, about a day before the root was updated. By 22:20 UTC on 9 October, DNSViz reported .pk as secure, and the IANA record for .pk shows a last update on the same day. The zone uses algorithm 13 (ECDSA P-256 with SHA-256) and NSEC3 with no additional iterations and an empty salt, as RFC 9276 recommends.

The scan checked two parts of each chain. It queried the DS record held in the .pk zone and the DNSKEY held in the domain's own zone. A domain counted as fully signed only if the whole chain, from root to .pk to domain, validated. The 1,230 domains that sign their zones but lack a DS in the parent are treated as unsigned by validating resolvers, because the .pk zone returns a signed proof that no DS exists. They include accenture.pk and nexlinx.net.pk.

The rest of the scan found 117,572 names (74 percent) unsigned, 25,875 that no longer exist, and 13,883 that could not be classified because their nameservers were unreachable or timed out.

The gap between signing a zone and publishing its DS record is not new. A 2017 USENIX Security study of .com, .net, and .org found that roughly 30 percent of signed domains had no DS in the parent. Signing a zone and getting its DS into the parent are separate tasks, done by different parties, and the domain owner or DNS provider generates the signing keys. In the .pk case, names such as com.pk, org.pk, edu.pk, and gov.pk are part of the .pk zone itself, so every DS record for those names would be published by one organization.

Source: [circleid.com](https://circleid.com/posts/pakistans-.pk-is-now-dnssec-signed-but-only-one-domain-validates)