https://nalar.dev/tags/infrastructure-security/ Recent content in Infrastructure Security on Nalar Hugo en-us Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/nsec3-trades-dnssec-name-exposure-for-operational-cost/ Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/nsec3-trades-dnssec-name-exposure-for-operational-cost/ <h1 id="nsec3-trades-dnssec-name-exposure-for-operational-cost">NSEC3 Trades DNSSEC Name Exposure for Operational Cost</h1> <p>A signed DNS zone has to authenticate absence as well as presence. When a resolver asks for a name that does not exist, a DNSSEC-validating resolver needs cryptographic evidence that the negative answer was not forged by an intermediary. The original NSEC mechanism supplies that evidence by linking existing names in canonical order.</p> <p>That design has a side effect: the links expose names. Following NSEC records can reveal much of a zone even when ordinary DNS queries do not provide an enumeration interface.</p>