Skip to main content
protocols.pageprotocols.page
NSEC3

NSEC3 Record

Active

NSEC3 is the hashed version of NSEC that prevents zone walking.

hash.name TTL IN NSEC3 hash-algorithm flags iterations salt next-hashed-name type-bitmap

In one line

NSEC3 is the hashed version of NSEC that prevents zone walking. Instead of listing the next actual domain name, NSEC3 uses SHA-1 hashes of names. An attacker cannot enumerate all domain names by following the chain because the hashes don't reveal the plaintext names. NSEC3PARAM records specify the hash parameters for the zone.

Description

NSEC3 (RFC 5155) addresses NSEC's zone walking vulnerability by hashing domain names before including them in the chain. The hash function (SHA-1), salt, and iteration count are stored in NSEC3PARAM records. Higher iteration counts slow down offline dictionary attacks but increase DNS server CPU load. RFC 9276 recommends iteration count of 0 for new NSEC3 deployments. NSEC3 is the dominant choice for signed zones that want to avoid enumeration.

Examples

NSEC3 record
shell
15R0VMJFA7FIHQ7BNHQGR3KQRFEVBC6E.example.com. IN NSEC3 1 0 0 - 2QB6BVABDS5UVKPN5... A MX
Query NSEC3
shell
dig example.com NSEC3PARAM +dnssec

Related Record Types

NSECDNSKEY

Specification

RFC 5155 – DNS NSEC3 record specification →