Query NSEC records to verify DNSSEC negative responses and zone coverage
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.
Query NSEC records to verify DNSSEC negative responses and zone coverage
This page provides original, human-reviewed information about NSEC record lookups, explaining authenticated denial of existence, walkable enumeration concerns, and when NSEC3 is the better choice.
NSEC (Next Secure) records are a crucial component of DNSSEC that provide authenticated denial of existence. They prove that a particular domain name or record type does not exist in a DNS zone, preventing attackers from spoofing non-existent records.
NSEC:Provides clear proof of non-existence but allows zone walking (enumeration of all domain names).
NSEC3:Uses hashed domain names to prevent zone walking while still providing denial of existence.
# Generate DNSSEC keys dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com dnssec-keygen -a RSASHA256 -b 1024 -n ZONE -f KSK example.com
# Sign zone with NSEC records dnssec-signzone -o example.com -t example.com.zone
# BIND configuration
zone "example.com" {
type master;
file "example.com.zone.signed";
key-directory "keys/";
auto-dnssec maintain;
};Submit DS records to your domain registrar:
# Generate DS record dnssec-dsfromkey Kexample.com.+008+12345.key
Symptoms: NSEC lookup returns no results
Possible Causes:
Solutions:
dig +dnssec SOA example.comdig +dnssec NSEC3PARAM example.comSymptoms: NSEC chain validation fails
Possible Causes:
Solutions:
Symptoms: NSEC records present but signatures invalid
Possible Causes:
Solutions:
dig +dnssec +multiline NSEC example.com- Query NSEC recordsdelv example.com- Validate DNSSEC chaindnssec-verify example.com.zone.signed- Verify zone signaturesnamed-checkzone example.com example.com.zone- Check zone syntaxNSEC records provide authenticated denial of existence but expose all domain names in a zone,allowing "zone walking" attacks. NSEC3 uses cryptographic hashes to hide actual domain nameswhile still providing the same security benefits, preventing zone enumeration.
This could mean: (1) DNSSEC is not enabled, (2) your domain uses NSEC3 instead of NSEC,(3) the zone is not properly signed, or (4) your DNS provider handles DNSSEC differently.Check with your DNS provider about their DNSSEC implementation.
Zone walking allows attackers to enumerate all subdomains in your zone, which could revealinternal infrastructure or services you prefer to keep private. While not directly exploitable,it provides reconnaissance information. Consider NSEC3 if privacy is a concern.
NSEC records are automatically generated when you sign your zone. They should be updatedwhenever you add or remove domain names from your zone. The RRSIG signatures for NSECrecords should be refreshed before they expire (typically every 30 days).
No, a zone can only use either NSEC or NSEC3, not both simultaneously. You must chooseone method for authenticated denial of existence. Most modern implementations prefer NSEC3for its privacy benefits.
A broken NSEC chain can cause DNSSEC validation failures, leading to resolution errorsfor end users. Resolvers may return SERVFAIL responses when they cannot validate thechain. This typically requires re-signing the zone to fix the chain integrity.
Most modern DNS providers support DNSSEC and NSEC records, but implementation details vary.Some providers automatically manage DNSSEC signing and use NSEC3 by default. Check withyour DNS provider about their specific DNSSEC capabilities and configuration options.
Our tools are designed to be intuitive, but if you need assistance, we're here to help.
Professional-grade email and DNS diagnostic tools trusted by IT professionals worldwide.