NSEC3PARAM Lookup

What are NSEC3PARAM Records?

NSEC3PARAM records define the parameters used for NSEC3 hashing in DNSSEC. They specify the hash algorithm, iteration count, and salt value used to create NSEC3 records, which provide authenticated denial of existence while preventing zone enumeration.

Key Components

• Hash Algorithm:Cryptographic function used (typically SHA-1)
• Flags:Control parameters (0=standard, 1=opt-out)
• Iterations:Number of hash iterations for security
• Salt:Random data to prevent rainbow table attacks

Security Benefits

• Prevents zone walking and enumeration attacks
• Maintains authenticated denial of existence
• Protects against rainbow table attacks with salt
• Configurable security level through iterations

Use Cases

• High-security domains requiring privacy protection
• Large zones where NSEC records would reveal structure
• Domains with sensitive subdomain information
• Compliance with privacy regulations

1. Enable DNSSEC

First, ensure DNSSEC is enabled for your domain:

2. Configure NSEC3 Parameters

Set appropriate NSEC3 parameters:

3. BIND Configuration

For BIND servers, configure NSEC3 in named.conf:

4. Parameter Recommendations

• Use SHA-1 (algorithm 1) - currently the only standardized option
• Set iterations between 5-15 for balance of security and performance
• Use a random salt of 8-16 bytes
• Consider opt-out (flags=1) for zones with many unsigned delegations

No NSEC3PARAM Records Found

Possible causes and solutions:

• Domain may not be using DNSSEC - enable DNSSEC signing
• Zone uses NSEC instead of NSEC3 - convert to NSEC3
• NSEC3PARAM record not published - check zone file
• DNS propagation delay - wait and retry

NSEC3 Validation Failures

Common validation issues:

• Incorrect hash algorithm - verify algorithm support
• Wrong iteration count - check parameter consistency
• Salt mismatch - ensure salt matches across records
• Clock skew - synchronize server time

Performance Issues

High iteration counts can cause problems:

• Reduce iteration count if queries are slow
• Monitor CPU usage on authoritative servers
• Consider hardware acceleration for hashing
• Balance security vs. performance requirements

Zone Enumeration Still Possible

If zone walking is still occurring:

• Verify NSEC3 is properly configured
• Check for NSEC records mixed with NSEC3
• Ensure all zone cuts use NSEC3
• Review opt-out configuration

What's the difference between NSEC and NSEC3?

NSEC provides authenticated denial of existence but allows zone enumeration. NSEC3 usescryptographic hashing to prevent zone walking while maintaining the same security properties.

How many iterations should I use?

RFC 5155 recommends 5-15 iterations for most zones. Higher values provide better securitybut increase computational cost. Consider your server capacity and security requirements.

Should I use a salt?

Yes, using a random salt prevents rainbow table attacks and adds security. Use 8-16 bytesof random data. The salt should be changed periodically for maximum security.

What does opt-out mean?

Opt-out (flags=1) allows unsigned delegations to exist without NSEC3 records. This isuseful for zones with many unsigned child zones, reducing the number of NSEC3 records needed.

Can I change NSEC3 parameters?

Yes, but changes require careful planning. You can publish new NSEC3PARAM records alongsideold ones during transition, then remove the old parameters after the TTL expires.

Why is SHA-1 still used?

SHA-1 is currently the only standardized hash algorithm for NSEC3. While SHA-1 has knownweaknesses, the NSEC3 use case is less vulnerable to collision attacks. SHA-256 supportis being developed.

How do I monitor NSEC3 performance?

Monitor query response times, CPU usage on authoritative servers, and resolver cache hit rates.High iteration counts or frequent parameter changes can impact performance.