NSEC

networkingsecurity

Stands for: Next Secure (record)

A DNSSEC record that proves a name does not exist.

Next Secure records (RFC 4034) chain the existing names in a zone so a resolver can prove authenticated denial - that a queried name genuinely is absent - rather than trusting an unsigned 'not found'.

NSEC proves a name does not exist by signing a statement that no names sort between two neighbouring ones. That construction is what lets DNSSEC authenticate a negative answer, which is otherwise impossible to sign because you cannot sign a record that is not there.

Its side effect is zone enumeration: following the chain of NSEC records from one name to the next walks the entire zone, revealing every name in it. For a public zone that may be acceptable, and for many it is a meaningful information leak, which is precisely the problem NSEC3 was created to address.

Also known as: nsec

← All glossary entries