NSEC record
An NSEC record proves that something doesn't exist in a signed zone. It names the next name in the zone and lists the record types at this one, so a signed "no" covers the gap between them. A side effect is that the whole zone can be listed by following the chain, which NSEC3 or on-the-fly answers avoid.
| Record type | NSEC |
|---|---|
| Type number | 47 |
| Used for | DNSSEC |
| How common | Specialist |
| Defined in | RFC 4034 |
Format
<name> <ttl> IN NSEC <next name> <types...>
| Field | What it means | Accepted values |
|---|---|---|
| Next name | The next name in the zone, in DNS order. | A host name. |
| Types | Record types that exist at this name. | Such as A MX TXT RRSIG NSEC. |
Check an NSEC record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid NSEC record.
| Part | What it means |
|---|---|
| Namealpha.example.com. | A full name: the final dot means nothing is added to it. |
| TTL300 | Resolvers may keep this answer for 5 minutes before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeNSEC | DNSSEC proof that a name doesn't exist. |
| Next namebeta.example.com. | The next name in the zone, in DNS order. Nothing exists between this name and that one, which proves a name doesn't exist. |
| TypesA AAAA RRSIG NSEC | The record types that exist at this name. Any type not listed provably doesn't. |
Examples
Proving a name doesn't exist
alpha.example.com. 300 IN NSEC beta.example.com. A AAAA RRSIG NSEC
Nothing exists between alpha and beta, so alphabet.example.com doesn't.
Compact denial
nope.example.com. 300 IN NSEC \000.nope.example.com. RRSIG NSEC NXNAME
Some hosts (such as Cloudflare) answer every miss with a made-up NSEC for just that name, which hides the rest of the zone.
Look up NSEC records
TTL
The SOA minimum. How TTL works
Common mistakes
- Thinking the zone is private when NSEC lets anyone walk it.
At your DNS host
- Created automatically by DNSSEC signers.
Questions
What is zone walking?
Following NSEC records from name to name to list every name in a signed zone. NSEC3 hashes the names to make this harder.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free