https://nalar.dev/tags/authenticated-denial/ Recent content in Authenticated Denial on Nalar Hugo en-us Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/nsec3-hashes-dnssec-denial-records-without-hiding-guessable-names/ Thu, 24 Sep 2026 00:00:00 +0000 https://nalar.dev/nsec3-hashes-dnssec-denial-records-without-hiding-guessable-names/ <p>A DNSSEC signature can authenticate data that exists, but a resolver also needs cryptographic evidence when a requested name or record type is absent. A plain unsigned <code>NXDOMAIN</code> response cannot provide that property: an attacker able to alter DNS traffic could fabricate the same response. NSEC3 supplies signed denial records while replacing clear-text owner names in the denial chain with hashes.</p> <p>RFC 5155 defines NSEC3 as an alternative to NSEC for authenticated denial of existence. Its main privacy-related distinction is narrow but useful: walking an NSEC chain directly reveals neighboring owner names, whereas NSEC3 exposes hashes that require additional work to map back to candidate names.</p>