Glossary
DNSSEC
NSEC / NSEC3
Records that prove a name does not exist, by signing the gaps between names that do. NSEC3 hashes the names so the zone cannot simply be enumerated; opt-out lets unsigned delegations be skipped, which speeds signing at the cost of proving less.
Defined in RFC 5155.
Where this appears
The lessons that use this term, and what each is for.
Domain Security FundamentalsDNSKEY, RRSIG, DS and NSECIdentify each DNSSEC record type in a real answer and say what job it does.DNS Security PractitionerNSEC enumerates your zoneWalk a zone using its own denial records, and say what that exposes.DNS Security PractitionerWhat NSEC3 fixed, and did notSay what NSEC3 hashing costs and why it did not end zone enumeration.DNS Security PractitionerAnswering on the flyExplain how a signer denies a name without ever listing the ones that exist.