NSEC3 record
NSEC3 is a DNSSEC record type, defined in RFC 5155, that lets a resolver cryptographically confirm a queried name genuinely doesn't exist in a signed zone -- authenticated denial of existence -- without the zone publishing every name it contains in a walkable, plaintext order. The original NSEC record proves non-existence the same way, but does so using the zone's real owner names arranged sequentially, which lets anyone walk the chain and enumerate every name in the zone, even ones never otherwise published. NSEC3 replaces those owner names with a salted cryptographic hash of each one, so proving a gap between two hashed values no longer reveals the names that would fall inside it. It also supports an Opt-Out flag, letting a zone with many unsigned delegated subdomains skip signing each one without weakening validation for the names that are signed.
By AdminKit team, Netbase JSC · Updated