NSEC Record

In one line

The NSEC (Next Secure) record is a DNSSEC record type that proves the non-existence of a DNS name or type. It creates a cryptographically verifiable chain of all existing names in a zone. When a resolver queries for a name that doesn't exist, the authoritative server returns an NSEC record proving the gap between two existing names.

Description

NSEC records form an ordered linked list of all names in a signed zone. Each NSEC record points to the next name in canonical order and lists all record types that exist at the current name. This allows authenticated denial of existence – a resolver can verify that a name truly doesn't exist without being vulnerable to negative answer spoofing. NSEC has a privacy issue: zone walking, where an attacker can enumerate all names by following the NSEC chain. NSEC3 was introduced to address this.

Examples

example.com. 3600 IN NSEC mail.example.com. A MX RRSIG NSEC DNSKEY

dig example.com NSEC +dnssec

Related Record Types