https://nalar.dev/tags/nsec/ Recent content in NSEC on Nalar Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/aggressive-dnssec-caching-reuses-authenticated-denial-proofs/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/aggressive-dnssec-caching-reuses-authenticated-denial-proofs/ <p>A conventional DNS negative cache remembers a negative result for a specific query. DNSSEC adds richer material to that response: NSEC and NSEC3 records can cryptographically prove that names or record types do not exist. RFC 8198 permits a validating resolver to reuse those cached proofs for later queries that fall inside the proven space.</p> <p>This behavior is called aggressive use of the DNSSEC-validated cache. It can suppress repeated authoritative lookups for names whose nonexistence is already established by validated data. The mechanism is more than a performance optimization: fewer unnecessary queries also reduce exposure of misspelled or random names beyond the recursive resolver and can absorb part of the load created by random-QNAME traffic.</p>