Модульні уроки (1/3)
NSEC, NSEC3 e prove negative
NSEC, NSEC3, and negative proofs
DNSSEC must prove not only that a record is present, but also that a name or type is absent. NSEC links names in sorted order and lists the types at a name. A validator checks the signatures and proof to confirm a negative answer. Walking NSEC links can reveal names in a zone.
NSEC3 hashes names to make simple enumeration less direct, but it is not encryption. Predictable names can still be guessed and tested. Opt-out can reduce cost in some delegation scenarios, but it changes which delegations are covered by proofs. Aggressive negative caching can let compatible resolvers reuse validated proofs for nearby queries.
References: RFC 4034 — NSEC · RFC 5155 — NSEC3 · RFC 8198 — aggressive caching
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
Does NSEC3 make zone names confidential?