In order for DNSSEC to be most effective, the standard needs to be deployed from the top to the bottom of the DNS hierarchy -- at the root zone, at top-level domains and at individual Web sites.

Last October, the Commerce Department issued a request for comments about deploying DNSSEC on the root zone. the Commerce Department to sign the root zone as soon as possible. Nothing has happened since then.

That's why DNSSEC developers have come up with a scheme called a that can be used to bypass the Commerce Department and move ahead with DNSSEC deployment without the root zone being signed. However, proponents of these repositories would prefer that Commerce mandate that the DNS root zone be signed.

"Signing the root has two benefits," says Internet pioneer Steve Crocker, who is currently CEO of Shinkuro. "From a technical perspective, it means that layer is signed...But from a political perspective, as soon as the root is signed that sends a very powerful signal that [DNSSEC] is for real, and everyone should do it."

Crocker says he believes Commerce will take action to sign the DNS root zone data.