Skip to content
Control Plane Labs
Search

NSEC3 record

Provides DNSSEC denial of existence using hashed owner names, reducing direct disclosure of the zone's names while preserving authenticated proofs.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

ROCCJAE2...example.com. 3600 IN NSEC3 1 0 10 A1B2 CDEF... A NS SOA RRSIG DNSKEY NSEC3PARAM

Typical uses

  • Authenticating NXDOMAIN and no-data answers in a signed zone
  • Reducing straightforward zone-name enumeration from denial records
  • Using opt-out for unsigned delegations in a large delegated zone
  • Checking whether a resolver's negative answer has a valid hashed interval proof

When it breaks, check

  • The hash algorithm, iteration count, salt, and opt-out flag must be interpreted from the published NSEC3 parameters
  • An NSEC3 proof uses hashed names and often requires several records for wildcard or delegation cases
  • Opt-out can leave unsigned delegations outside the authenticated name coverage
  • A valid NSEC3 record is not enough when its RRSIG or the DNSKEY-to-DS chain fails validation

What the NSEC3 record does

NSEC3 is an authenticated denial-of-existence record for signed zones that prefer not to publish clear-text owner names in every interval. The record carries a hash algorithm, flags, iteration count, salt, next hashed owner name, and a type bitmap. A resolver hashes the queried name with the zone’s parameters, finds the covering interval, and validates its signature.

NSEC3 does not make a zone confidential: hashes of predictable names can still be tested, and other DNS records reveal names. Opt-out reduces signing and record-management work around unsigned delegations, but it also means a proof can cover an interval without proving that every delegated name is signed. Compare NSEC when the operational priority is simple, visible proofs.

Zone-file and wire format

NSEC3 RDATA is hash-algorithm flags iterations salt next-hashed-owner type-bitmap. The hash algorithm and iteration count define how the queried name is transformed; flags include opt-out; salt changes the hash input; and the type bitmap lists records at the hashed owner. The presentation form uses base32hex for hashed names and salt values.

; illustrative NSEC3 record; hash and salt are shortened
ROCCJAE2...example.com. 3600 IN NSEC3 1 0 10 A1B2 CDEF... A NS SOA RRSIG DNSKEY NSEC3PARAM

Common uses

NSEC3 fits signed registries and zones that want authenticated denial without making a simple interval listing of clear-text owner names. Choose parameters deliberately: higher iteration counts add resolver work, and opt-out changes the proof model around unsigned delegations. It is not a replacement for ZONEMD integrity checking or for access control on zone transfers.

Troubleshooting

Capture the complete authority section of the negative response and read the NSEC3PARAM record from the zone apex. Recompute the hash with the published algorithm, salt, and iterations, then check which NSEC3 interval covers it. Validate every relevant RRSIG and confirm that the parent DS still selects the active DNSKEY.

If only some resolvers fail, compare their supported NSEC3 parameters and cached proofs. For opt-out zones, determine whether the response crosses an unsigned delegation; do not “repair” the zone by changing flags without a signing and rollover plan. Check SOA serials and RRSIG times after any parameter change.

dig example.com NSEC3PARAM +dnssec +noall +answer
dig example.com missing-name A +dnssec +noall +authority

# Inspect the authority section from the authoritative server.
dig @ns1.example.net missing-name A +norecurse +dnssec

The defining RFC

NSEC3 is defined by RFC 5155, including hashed owner names, iterations, salt, and opt-out semantics. The validation model builds on RFC 4034 and RFC 4035. The IANA DNS Parameters registry records the type and related algorithm assignments.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types