<commit_before><section id="why-is-dnssec-important">
 <title>Why is DNSSEC Important? (Why Should I Care?)</title>
 <para>You might be thinking to yourself: all this DNSSEC stuff sounds
 wonderful, but why should I care? Below are some reasons why you may want to
 consider deploying DNSSEC:

  <orderedlist>
   <listitem>
    <simpara><emphasis>Be a good netizen</emphasis>: By enabling DNSSEC
    validation (as described in <xref linkend="dnssec-validation" />) on your
    DNS servers, you're protecting your users or yourself a little more by
    checking answers returned to you; by signing your zones (as described in
    <xref linkend="dnssec-signing" />), you are making it possible for other
    people to verify your zone data. As more people adopt DNSSEC, the Internet
    as a whole becomes more secure for everyone.</simpara>
   </listitem>

   <listitem>
    <simpara><emphasis>Compliance</emphasis>: You may not even get a say
    whether or not you want to implement DNSSEC, if your organization is
    subject to compliance standards that mandate it. For example, the US
    government set a deadline back in 2008, to have all <code>.gov</code> sub
    domains signed by the December 2009 <footnote><para>The Office of
    Management and Budget (OMB) for the US government published a memo in 2008
    (<ulink
    url="www.whitehouse.gov/sites/default/files/omb/memoranda/fy2008/m08-23.pdf"
    />), requesting all <code>.gov</code> sub-domains to be DNSSEC signed by
    December 2009. This explains why <code>.gov</code> is the most deployed
    DNSSEC domain currently, with more than 80% sub domains
    signed.</para></footnote>. So if you operated a sub domain in
    <code>.gov</code>, you must implement DNSSEC in order to be compliant. One
    of the widely used compliance standards, PCI DSS for the payment card
    industry, has been rumored to list DNSSEC as a requirement or
    recommendation, as part of its on-going efforts to enhance security for
    online payment transactions.
<!-- TODO: find source for the PCI DSS "rumor" and make this more precise. -->
    ICANN also requires that all new top-level domains support DNSSEC.</simpara>
<!-- CITE: http://www.internetsociety.org/deploy360/blog/2013/09/icanns-2013-raa-requires-domain-name-registrars-to-support-dnssec-ipv6A -->
   </listitem>
<commit_msg>Added comments about PCI-DSS rumor for DNSSEC as a comment.<commit_after><section id="why-is-dnssec-important">
 <title>Why is DNSSEC Important? (Why Should I Care?)</title>
 <para>You might be thinking to yourself: all this DNSSEC stuff sounds
 wonderful, but why should I care? Below are some reasons why you may want to
 consider deploying DNSSEC:

  <orderedlist>
   <listitem>
    <simpara><emphasis>Be a good netizen</emphasis>: By enabling DNSSEC
    validation (as described in <xref linkend="dnssec-validation" />) on your
    DNS servers, you're protecting your users or yourself a little more by
    checking answers returned to you; by signing your zones (as described in
    <xref linkend="dnssec-signing" />), you are making it possible for other
    people to verify your zone data. As more people adopt DNSSEC, the Internet
    as a whole becomes more secure for everyone.</simpara>
   </listitem>

   <listitem>
    <simpara><emphasis>Compliance</emphasis>: You may not even get a say
    whether or not you want to implement DNSSEC, if your organization is
    subject to compliance standards that mandate it. For example, the US
    government set a deadline back in 2008, to have all <code>.gov</code> sub
    domains signed by the December 2009 <footnote><para>The Office of
    Management and Budget (OMB) for the US government published a memo in 2008
    (<ulink
    url="www.whitehouse.gov/sites/default/files/omb/memoranda/fy2008/m08-23.pdf"
    />), requesting all <code>.gov</code> sub-domains to be DNSSEC signed by
    December 2009. This explains why <code>.gov</code> is the most deployed
    DNSSEC domain currently, with more than 80% sub domains
    signed.</para></footnote>. So if you operated a sub domain in
    <code>.gov</code>, you must implement DNSSEC in order to be compliant. One
    of the widely used compliance standards, PCI DSS for the payment card
    industry, has been rumored to list DNSSEC as a requirement or
    recommendation, as part of its on-going efforts to enhance security for
    online payment transactions.
<!-- TODO: find source for the PCI DSS "rumor" and make this more precise. -->
<!-- jkuo: Source of the rumor:
http://www.internetsociety.org/deploy360/blog/2014/08/infoworld-why-you-need-to-deploy-dnssec-now/
I have heard verbally from PCI-savy friends of the same rumor, but that's 
obviously not reference-able. This is the only thing I could find online. If
it is not appropriate to be spreading rumors, we could remove or rephase it.
-->
    ICANN also requires that all new top-level domains support DNSSEC.</simpara>
<!-- CITE: http://www.internetsociety.org/deploy360/blog/2013/09/icanns-2013-raa-requires-domain-name-registrars-to-support-dnssec-ipv6A -->
   </listitem>

{'fraction_non_alphanumeric': 0.08529411764705883, 'fraction_numerical': 0.017450980392156864, 'mean_word_length': 3.753960857409133, 'pattern_counts': {'":': 0, '<': 72, '<?xml version=': 0, '>': 72, 'https://': 0, 'lorem ipsum': 0, 'www.': 5, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '924215', 'n_tokens_mistral': 1530, 'n_tokens_neox': 1398, 'n_words': 635}