Strengthening Internet Security in Africa: .bf and .cm Successfully Deploy DNSSEC

Author: Yazid AKANHO, Technical Engagement Manager, MEA Region,

Contributors:

Alain AINA, General Manager, Digital Intelligence Services and CDA DNSSEC Roadshow Consultant
Albert KAMGA, Director, Standardization and Cooperation, Agence Nationale des Technologies de l'Information et de la Communication (ANTIC), Cameroon
Izaï TOE, Executive Secretary, Association Burkinabè des Domaines Internet (ABDI), Burkina Faso

On 3 April and 8 April 2025, respectively, Burkina Faso’s .bf and Cameroon’s .cm country code top-level domains (ccTLDs) officially began publishing Domain Name System Security Extension (DNSSEC)-signed versions of their zone files to the global Internet. Both ccTLDs became DNSSEC operational following the publication of their keys in the root zone, .cm on 23 April, and .bf on 30 April. Celebrated through online ceremonies, this milestone marks a significant step for both ccTLDs, and for the broader effort to advance the Domain Name System (DNS) and Internet security in Africa.

The deployments were completed with support from the Coalition for Digital Africa’s DNSSEC Roadshow, a project designed to strengthen operational capacity for DNS security across the continent. Both registry teams, guided by the roadshow consultant and ICANN, translated technical assessments into full-scale deployments.

Building on Earlier Engagement

Both Burkina Faso and Cameroon had previously participated in the DNSSEC Roadshow in 2014 – Burkina Faso in May, Cameroon in September. However, at that time, neither registry completed the deployment.

The current roadshow model reflects lessons learned from that experience. It offers sustained technical support, infrastructure reviews, training, and operational guidance, helping registries move beyond initial engagement to full implementation. That deeper support proved critical to the success of both deployments.

Burkina Faso’s Deployment

Burkina Faso rejoined the Roadshow in June 2023, shortly after the ccTLD manager for .bf, Autorité de Régulation des Communications Électroniques et des Postes (ARCEP), brought in a new technical platform operator, Association Burkinabè des Domaines Internet (ABDI).

A pre-assessment conducted in June 2023 identified areas of improvement in infrastructure and operations. In July 2023, the roadshow facilitated in-person activities in Ouagadougou, including:

A one-day awareness session with the local Internet community
Two days of technical hands-on training with registry engineers, Internet Service Providers (ISPs), hosting providers, and government technical teams
A targeted session with the ccTLD Manager and Operator to finalize DNSSEC deployment methodology

From July 2023 to March 2025, ABDI systematically:

Deployed a DNSSEC testbed
Conducted intensive zone signing and key management procedures in test environment
Upgraded DNS infrastructure and introduced monitoring systems
Prepared the live system for signing

In April 2025, the registry began serving the signed zone file and after a few weeks of monitoring, the ccTLD successfully submitted its Delegation Signer (DS) record to the root zone. Work is underway to finalize the DNSSEC Practice Statement (DPS) and operational processes.

Cameroon’s Deployment

Cameroon’s engagement with the roadshow began in April 2024 with an assessment of the ccTLD infrastructure and operations. Then, .cm, along with four other ccTLDs (.bf, .bw, .cv, and .ng), participated in a five-day online cryptography workshop comprising a mix of lectures and hands-on lab practices in June 2024. An in-person three-day DNSSEC Roadshow was also organized in Yaoundé in August 2024 as follows:

Two days of technical hands-on with engineers and technical staff in charge of DNS at the registry, ISPs, hosting providers, and government infrastructures.
A targeted session with the ccTLD Registry to finalize the DNSSEC deployment plan.

After the training, technical team from Agence Nationale des Technologies de l'Information et de la Communication (ANTIC), the ccTLD Manager for .cm:

Built a DNSSEC testbed
Conducted detailed testing of deployment scenarios
Improved DNS infrastructure based on the assessment’s recommendations

A project team of five specialists in DNS operations, Public Key Infrastructure (PKI) administration, systems, and incident response, under the coordination of ANTIC’s Director of Standardisation and Cooperation, led the work internally. This approach allowed .cm to move the DNSSEC implementation from planning to production in under a year.

A Broader Impact

The deployments in Burkina Faso and Cameroon show that while DNSSEC implementation requires strong technical support, internal preparation and strong coordination are equally critical. In Burkina Faso, efforts centered on establishing foundational systems and procedures. In Cameroon, existing structures allowed the project to move faster.

The pre-assessments that extended technical assistance and the more structured deployment approach offered under the current roadshow were key factors in both successes.

Through their work, .bf and .cm contribute to a growing group of African ccTLDs committed to strengthening the Internet infrastructure. Their achievements demonstrate that, with focused support and internal commitment, sustainable security improvements are possible and within reach for more registries in Africa and across the world.