NSEC record
NSEC is the original DNSSEC record type, defined in RFC 4034 and RFC 4035, that lets a resolver cryptographically confirm a queried name genuinely doesn't exist in a signed zone -- authenticated denial of existence -- rather than trusting an unsigned negative response. Each NSEC record names the next owner name that actually exists in the zone's canonical sort order, plus a bitmap of which record types exist at the current name, so a signed NSEC record proving no name falls between two neighbors also proves a queried name in that gap isn't a forged answer. The tradeoff is built into the mechanism: because the chain links real, sequential owner names, anyone can query it record by record and reconstruct the zone's entire name list, even names never otherwise published -- zone enumeration, or zone walking. NSEC3 closes that gap by replacing each owner name with a salted hash, so the same proof no longer reveals what the zone actually contains.
By AdminKit team, Netbase JSC · Updated