Summary

  • Ondřej Filip published CZ.NIC's proposed DNSSEC implementation plan for .cz and ENUM in March 2008 and invited public comment before the rollout.
  • Signed .cz domains numbered fewer than 1,500 at the end of 2009. Two registrars enabled DNSSEC in bulk for eligible customers in early 2010; CZ.NIC counted more than 87,000 protected domains in March and more than 110,000 by year-end.

The feature met the checkbox

One week in 2010 did what many security speeches cannot. CZ.NIC reported that more than 70,000 .cz domains had gained DNSSEC protection, lifting the total above 87,000. The immediate actors were two registrars, WEB4U and ACTIVE 24. They signed customers' domains hosted on their own name servers and said they would switch it on automatically for new domains they registered and managed. A security protocol had reached the place where ordinary customers make almost no decision at all: the default workflow.

Ondřej Filip had opened the door two years earlier. As CZ.NIC's executive director, he published the proposed implementation plan for DNSSEC in .cz and ENUM in March 2008 and asked readers to send comments. His November 2008 ICANN slides show a sequence with room for other hands: public announcement, final design, registrar testing, a signed .cz zone, then the start of registrations by end users. The registry could prepare the zone and the interface. Registrars still had to put the feature in front of their customers.

At first, adoption walked. In August 2009, CZ.NIC celebrated the first 1,000 protected .cz names. Filip described DNSSEC as something users would take up gradually. He pointed to banks, media and public offices as places where the integrity of a domain name mattered plainly. The registry's later 2010 report says the year 2009 ended below 1,500 protected names. The protocol was available; the queue at the counter was short.

The March 2010 burst reveals what changed at the counter. WEB4U and ACTIVE 24 had a defined set of eligible domains: their own customers whose DNS they also operated. Signing that set in bulk let one operational decision reach thousands of names. Their stated automatic treatment of newly registered and managed domains turned a one-week campaign into a continuing intake path. Filip had opened the plan and explained the stakes; the registrars turned it into customer action.

By the end of 2010, CZ.NIC counted more than 110,000 protected .cz domains. That is a count of signed names and a tidy lesson in implementation: the registry made the capability legible and available, then registrars made it routine. Filip's strongest line in this story is the public plan, followed by the moment when somebody else's customer flow began to carry it.