NSEC3PARAM

NSEC3PARAM is a DNSSEC record type that provides a mechanism for authenticated denial of existence. It is part of the NSEC3 (Next Secure) record specification, which was developed to address certain limitations of the original NSEC record. The primary purpose of NSEC3 and NSEC3PARAM is to prevent zone enumeration attacks by hashing the names of DNS records.

When NSEC3 is implemented, zone owners can create NSEC3 records that cover ranges of hashed names. These NSEC3 records provide proof that no records exist within a given hashed range. The NSEC3PARAM record, however, does not directly prove non-existence. Instead, it contains parameters that are used by authoritative DNS servers to generate the hashed names and the corresponding NSEC3 records.

The NSEC3PARAM record specifies the algorithm used for hashing, the flags for the NSEC3 records, and the number of iterations for the hash function. This information is crucial for validating resolvers to correctly interpret and verify the NSEC3 records presented by the authoritative server. Without the NSEC3PARAM record, a validating resolver would not have the necessary parameters to perform the cryptographic operations required to confirm the denial of existence. In essence, NSEC3PARAM acts as a key or configuration setting for the NSEC3 hashing process.