NSEC3
acronymnetworkingsecurity
Stands for: Next Secure version 3 (record)
A hashed version of NSEC that hides a zone's contents.
Next Secure version 3 (RFC 5155) provides the same authenticated denial as NSEC but over hashed names, so an attacker cannot walk the chain to enumerate every name in the zone.
NSEC3 does what NSEC does, proving non-existence, but over hashed names, so following the chain yields hashes rather than the names themselves. It was introduced to stop trivial zone enumeration.
The protection is real and weaker than it appears. A hash of a name is subject to offline guessing, and tooling exists to recover a large fraction of a typical zone's names from a collected NSEC3 chain, especially where names are short or predictable. Opt-out mode reduces signing overhead for large delegation-heavy zones at the cost of leaving unsigned delegations unproven. The honest summary is that NSEC3 raises the cost of enumeration rather than preventing it.
Also known as: nsec3