# NSEC record

An NSEC record proves that something doesn't exist in a signed zone. It names the next name in the zone and lists the record types at this one, so a signed "no" covers the gap between them. A side effect is that the whole zone can be listed by following the chain, which NSEC3 or on-the-fly answers avoid.

- Record type: NSEC
- Type number: 47
- Used for: DNSSEC
- How common: Specialist
- Defined in: RFC 4034

## Format

```
<name> <ttl> IN NSEC <next name> <types...>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Next name | The next name in the zone, in DNS order. | A host name. |
| Types | Record types that exist at this name. | Such as `A MX TXT RRSIG NSEC`. |

## Examples

### Proving a name doesn't exist

```
alpha.example.com. 300 IN NSEC beta.example.com. A AAAA RRSIG NSEC
```

Nothing exists between alpha and beta, so alphabet.example.com doesn't.

### Compact denial

```
nope.example.com. 300 IN NSEC \000.nope.example.com. RRSIG NSEC NXNAME
```

Some hosts (such as Cloudflare) answer every miss with a made-up NSEC for just that name, which hides the rest of the zone.

## TTL

The SOA minimum.

## Common mistakes

- Thinking the zone is private when NSEC lets anyone walk it.

## At your DNS host

- Created automatically by DNSSEC signers.

## Questions

### What is zone walking?

Following NSEC records from name to name to list every name in a signed zone. NSEC3 hashes the names to make this harder.

## Related

- [NSEC3 record](https://lemon.domains/dns-records/nsec3.md)
- [RRSIG record](https://lemon.domains/dns-records/rrsig.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/nsec