Skip to content
Control Plane Labs
Search

NSEC3PARAM record

Publishes the NSEC3 hashing parameters a validating resolver needs when interpreting an NSEC3-signed zone.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

example.com. 3600 IN NSEC3PARAM 1 0 10 A1B2

Typical uses

  • Advertising the active NSEC3 hash algorithm, flags, iterations, and salt
  • Letting signers and validators agree on how owner names are hashed
  • Planning a controlled NSEC3 parameter rollover
  • Diagnosing mismatches between a zone signer and the published denial records

When it breaks, check

  • The NSEC3PARAM RRset is published at the zone apex and must be DNSSEC-valid
  • The parameters must match the NSEC3 records used to prove the response
  • A salt change creates a new hashed namespace and should be rolled out as a planned DNSSEC change
  • Do not increase iterations blindly; resolver cost and operational compatibility must be measured

What the NSEC3PARAM record does

NSEC3PARAM is the zone-apex control record for NSEC3. It describes how an owner name is hashed before the signer creates NSEC3 records. The same algorithm, iterations, and salt must be used when a validator or diagnostic tool reconstructs the interval for a query. Flags primarily communicate the opt-out mode.

Parameter changes are not cosmetic. A new salt or iteration count creates a different set of hashed owner names, so a signer must publish compatible denial records and signatures during the transition. Keep the parent DS and DNSKEY chain healthy while the new material propagates. The DNS lookup tool can show the published parameter, while NSEC3 explains the proof that consumes it.

Zone-file and wire format

NSEC3PARAM RDATA is hash-algorithm flags iterations salt. The algorithm is an assigned hash identifier, flags carry the opt-out setting, iterations controls repeated hashing, and salt is a hexadecimal value or a hyphen for an empty salt. Unlike NSEC3, the record does not carry a next hashed name or type bitmap.

; illustrative parameters; measure resolver cost before choosing values
example.com. 3600 IN NSEC3PARAM 1 0 10 A1B2

Common uses

NSEC3PARAM is useful to DNSSEC operators, signers, and incident responders because it makes the active denial parameters visible at the zone apex. It should be managed with the signing configuration and rollover runbook. It is not a general hashing configuration record, and it does not replace DNSKEY, DS, or the RRSIG records that establish authenticity.

Troubleshooting

Query NSEC3PARAM and a representative negative answer from the same authoritative server. Compare the published parameters with the signer configuration and confirm that the NSEC3 records’ hash labels and RRSIGs correspond. Validate the apex RRset before trusting the values.

If validators return SERVFAIL after a change, check for mixed parameters across authoritative servers, expired signatures, stale parent DS data, and an iteration count that a resolver cannot process within its limits. During a rollover, watch SOA serials and signature inception and expiration times, and keep the prior proof set available until caches have aged out.

dig example.com NSEC3PARAM +dnssec +noall +answer
dig example.com missing-name A +dnssec +noall +authority

# Compare the authoritative parameter record directly.
dig @ns1.example.net example.com NSEC3PARAM +norecurse +dnssec

The defining RFC

NSEC3PARAM is defined by RFC 5155, section 4. The RFC specifies the parameter fields and their relationship to NSEC3 records and DNSSEC validation. The IANA DNS Parameters registry records the assigned type and NSEC3-related values.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types