suggested using split domains, a technique that is known to be possible but is difficult to deploy correctly, and has the security weaknesses noted above. On 22 August 2008, the Office of Management and Budget (OMB) released a memorandum requiring U.S. Federal Agencies to deploy DNSSEC across .gov sites; the .gov root must be signed by January 2009, and all subdomains under .gov must be signed by December 2009. While the memo focuses on .gov sites, the U.S. Defense Information Systems Agency says it intends to meet OMB DNSSEC requirements in the .mil (U.S. military) domain as well. NetworkWorld's Carolyn Duffy Marsan stated that DNSSEC "hasn't been widely deployed because it suffers from a classic chicken-and-egg dilemma... with the OMB mandate, it appears the egg is cracking." Deployment in resolvers Several ISPs have started to deploy DNSSEC-validating DNS recursive resolvers. Comcast became the first major ISP to do so in the United States, announcing their intentions on October 18, 2010 and completing deployment on January 11, 2012. According to a study at APNIC, the proportion of clients who exclusively use DNS resolvers that perform DNSSEC validation rose to 8.3% in May 2013. About half of these clients were using Google's public DNS resolver. In September 2015, Verisign announced their free public DNS resolver service, and although unmentioned in their press releases, it also performs DNSSEC validation. By the beginning of 2016, APNIC's monitoring showed the proportion of clients who exclusively use DNS resolvers that perform DNSSEC validation had increased to about 15%. DNSSEC support Google's public recursive DNS server enabled DNSSEC validation on May 6, 2013. BIND, the most popular DNS management software, enables DNSSEC support by default since version 9.5. The Quad9 public recursive DNS has performed DNSSEC validation on its main 9.9.9.9 address since it was established on May 11, 2016. Quad9 also provides an alternate service which does not perform DNSSEC validation, principally for debugging. IETF publications Domain Name System Security Extensions Indicating Resolver Support of DNSSEC DNSSEC and IPv6 A6 Aware Server/Resolver Message Size Requirements A Threat Analysis of the Domain Name System DNS Security Introduction and Requirements (DNSSEC-bis) Resource Records for the DNS Security Extensions (DNSSEC-bis) Protocol Modifications for the DNS Security Extensions (DNSSEC-bis) Storing Certificates in the Domain Name System (DNS) The DNSSEC Lookaside Validation (DLV) DNS Resource Record Minimally Covering NSEC Records and DNSSEC On-line Signing Use of SHA-256 in DNSSEC Delegation Signer