Domain name registrar like Hover, NameCheap, NameBright and NameSilo still do not yet support DNSSEC (nor have an ETA for it!). Here is a list of DNSSEC supporting registrars: https://www.icann.org/en/news/in-focus/dnssec/deployment
Based on pricing ($9.99/.com) and a growing irritation with GoDaddy, I finally moved my domains to Dynadot:
That registrar list is way out of date. Sadly, none of the entities involved nor historical list maintainers have made it easy to find an updated one, but if they did, Joker would be on it.
It was one of the few lists I found. Although the url redirects to an url containing 'deployment-2012-02-25-en' the page actually states 'Last updated: 27 May 2014', so it's not so out of date.
If your registrar currently accepts DS records, please
send an email with subject "DNSSEC REGISTRAR UPDATE"
and body containing company name, country location, URL,
what TLDs you accept DS records for, whether your Web
interface supports DS records, whether you provide
DNSSEC signing services to dnssec@icann.org and the
Security team will add your registrar to this DNSSEC
page.
Take a look at the RFCs coming out recently. DANE, in particular.
DNSSEC is an important trust root that can be used to pin certificates in addition to PKIX (CAs), or, in some practical cases (such as mailservers), instead of them.
FWIW, I left Namecheap for GKG.net for the sole reason that Namecheap didn't support DNSSEC. And yes, I have deployed DNSSEC and DANE. On https for emailprivacytester.com, and on https, smtp, imap and xmpp for grepular.com.
I'm guessing for DNSSEC, the usage is probably low and for DANE it's probably almost non-existant.
FWIW, I use the Firefox addon "DNSSEC Validator" (also does DANE) - https://www.dnssec-validator.cz/ - So if somebody managed to MITM my connection and insert a different, but still trusted, cert in the way, I'd notice.
DNSSEC/DANE would probably see a lot more adoption if one or more of the main browsers did this sort of validation by default.
