Authenticated Denial

NSEC3 Hashes DNSSEC Denial Records Without Hiding Guessable Names

A DNSSEC signature can authenticate data that exists, but a resolver also needs cryptographic evidence when a requested name or record type is absent. A plain unsigned NXDOMAIN response cannot provide that property: an attacker able to alter DNS traffic could fabricate the same response. NSEC3 supplies signed denial records while replacing clear-text owner names in the denial chain with hashes. RFC 5155 defines NSEC3 as an alternative to NSEC for authenticated denial of existence. Its main privacy-related distinction is narrow but useful: walking an NSEC chain directly reveals neighboring owner names, whereas NSEC3 exposes hashes that require additional work to map back to candidate names.