NSEC
type 47RFC 4034NSEC (Next Secure, type 47, RFC 4034) proves authenticated denial of existence. When a DNSSEC-signed zone is queried for a name or type that does not exist, the authoritative server returns the NSEC record that spans the gap in the zone's sorted namespace. NSEC records form a linked list of all names in the zone. The vulnerability: NSEC allows zone enumeration (walking the entire zone by following the chain), which led to the development of NSEC3.
Details
NSEC provides cryptographically verifiable proof that a DNS name or record type does not exist.
Non-existence problem without NSEC: Without DNSSEC, a resolver cannot distinguish a legitimate NXDOMAIN from an attacker injecting a fake NXDOMAIN. NSEC solves this by providing a signed record that covers the gap.
NSEC linked list: NSEC records form a sorted chain of all names in the zone. The last name's NSEC points back to the zone apex, creating a circular linked list. To prove name X does not exist, return the NSEC whose owner name is the greatest name less than X and whose Next Domain Name is greater than X.
Type bitmap: Each NSEC record includes a bitmap of all record types that DO exist at the owner name. This proves a type does not exist at a name that DOES exist (e.g., there is an A record but no AAAA).
Zone walking attack: An attacker can enumerate all names in a zone by following NSEC records in sequence: query for aaa.example.com → get NSEC from example.com → (example.com, www.example.com) query for www1.example.com → get NSEC from www.example.com → (www.example.com, mail.example.com) ... repeat until full zone is enumerated This reveals all internal hostnames. NSEC3 was designed to prevent this.
Wire format fields
| Field | Description |
|---|---|
| Next Domain Name | The next owner name in canonical DNS sort order. The sorted zone is a circular linked list; the last name's Next Domain points to the zone apex. |
| Type Bit Maps | Bitmap of all DNS record types that exist at this owner name. Proves a specific type does not exist at a name that otherwise exists. |
Zone file example
; NSEC chain for a small zone: example.com with only www and mail ; Sorted order: example.com → mail.example.com → www.example.com → (back to example.com) example.com. IN NSEC mail.example.com. A NS SOA DNSKEY RRSIG NSEC mail.example.com. IN NSEC www.example.com. A MX RRSIG NSEC www.example.com. IN NSEC example.com. A RRSIG NSEC ; Query for nonexistent ftp.example.com: ; Resolver receives NSEC for example.com pointing to mail.example.com ; ftp.example.com sorts between example.com and mail.example.com ; → Proven that ftp.example.com does not exist (signed) ; Zone walk: follow Next Domain Name until you reach the start again → full zone