Bangladesh's .BD ccTLD Completes DNSSEC Rollout Across Five SLDs

Bangladesh Telecommunications Company Limited (BTCL), operator of the .BD country-code top-level domain, has completed DNSSEC deployment across five second-level domains: ac.bd (academic), gov.bd (government), com.bd (commercial), net.bd, and org.bd. The work, described in detail by BTCL domain operations lead Joyeeta Sen Rimpee in a post on the APNIC Blog, brought the first verified chain of trust from the DNS root to a .BD leaf domain on 26 August 2025, when kuet.ac.bd — the domain of Khulna University of Engineering & Technology — achieved end-to-end DNSSEC validation.

Prior to August 2025, not a single second-level domain under .BD carried DNSSEC protection, leaving roughly 50,000 registered domains without cryptographic authentication. BTCL had established signing between the root zone and the .BD nameservers during an earlier phase, work attributed to Md. Anwar Parvez, who initiated that portion of the project. However, an economy-wide DNS blackout subsequently disrupted operations and stalled further progress.

The deployment effort resumed in earnest after Sen Rimpee attended the Phoenix Summit in May 2025, where hands-on training led by Philip Paeps of the Network Startup Resource Center provided the operational confidence to proceed at scale. A separate APNIC workshop held in Bangladesh in June 2024, led by APNIC Senior Network Analyst Md. Abdul Awal, had earlier introduced the team to DNSSEC concepts; Awal also served as a remote debugging partner throughout the 2025 rollout.

The technical stack relied on BIND 9.9+ running auto-dnssec maintain with inline signing — acknowledged as aging infrastructure, but sufficient to complete the rollout. Separate KSK and ZSK pairs, both using ECDSA P-256 with SHA-256 (Algorithm 13), handled zone signing. SHA-1 digest records discovered during deployment were removed in favor of SHA-256-only DS records, in line with current IETF guidance. Validation tooling included DNSViz for chain-of-trust visualization and the Verisign Labs DNSSEC Debugger for per-record signature checks.

Three operational problems surfaced mid-deployment. BTCL's registrant portal had no mechanism to accept DS record submissions, requiring manual intervention by an administrator until the feature was added. DNSViz subsequently revealed a stale DS record referencing a deleted KSK (Algorithm 8, Key Tag 26044), which was cleared via the IANA portal. Firewall rules silently dropping UDP packets caused child-zone validation failures unrelated to the cryptographic configuration; correcting those rules and verifying EDNS0 support resolved the issue.

Government domains under gov.bd were signed next, with quicksign.gov.bd as the first, and challenges in that phase were resolved by September 2025. Commercial domains followed, with primebank.com.bd serving as a landmark validation for com.bd; that phase completed by November 2025.

DNSViz now shows a clean SECURE status across the full .BD hierarchy, and resolvers at global vantage points consistently return the AD (Authenticated Data) flag for signed zones.

Planned next steps include migrating to dnssec-policy to replace the legacy auto-dnssec maintain configuration, introducing NSEC3 for zone enumeration resistance, establishing a formal key-rollover schedule, adopting HSM-based key storage, and deploying anycast for authoritative nameservers. Automating DS record submission — a contribution from the REVE Systems team — is described as essential groundwork for scaling DNSSEC enrollment to individual registrants.