NSECNSEC3

NSECNSEC3 is not a formal protocol or standard by itself; it is an informal term used to discuss the DNSSEC mechanisms that prove non-existence of a domain name or record within a signed zone, namely NSEC and NSEC3 records. In DNSSEC, proofs of non-existence are required when a queried name or type does not appear in the zone data. NSEC and NSEC3 address this need with different approaches and trade-offs.

NSEC, the original method, provides authenticated denial of existence by listing the next owner name in lexicographic order along with the current name. A DNS response can thus show that a particular name does not exist by proving it lies between two adjacent names in the zone. While simple and efficient, NSEC reveals the zone’s overall contents to observers, creating a potential privacy risk known as zone walking.

NSEC3 improves privacy by hashing owner names with a salt and a configurable number of iterations before placing them in the denial of existence chain. This means that the actual names are not exposed in the proofs, reducing the risk of enumerating the zone’s contents. An NSEC3PARAM record carries the chosen hash algorithm, salt, and iteration count, and some deployments may use opt-out configurations for large zones.

In practice, DNS operators may deploy NSEC, NSEC3, or both across different zones, depending on privacy, performance, and operational considerations. Both mechanisms are described in DNSSEC standards: NSEC in RFC 4033/4034/4035 and NSEC3 in RFC 5155. The term NSECNSEC3 appears in discussions as a shorthand for the pair or for comparing their properties, rather than as a distinct technical entity.