NSEC3 record
NSEC3 does the same job as NSEC, proving a name doesn't exist, but with hashed names so the zone can't simply be listed. Large TLDs such as .com use it with opt-out, which skips unsigned delegations. Current advice is zero extra iterations and no salt.
| Record type | NSEC3 |
|---|---|
| Type number | 50 |
| Used for | DNSSEC |
| How common | Specialist |
| Defined in | RFC 5155, RFC 9276 |
Format
<hash>.<zone> <ttl> IN NSEC3 <hash algorithm> <flags> <iterations> <salt> <next hash> <types...>
| Field | What it means | Accepted values |
|---|---|---|
| Hash algorithm | Always 1 (SHA-1). | 1 |
| Flags | 1 means opt-out. | 0 or 1. |
| Iterations | Extra hash rounds. | 0 recommended (RFC 9276). |
| Salt | Added before hashing. | - (none) recommended. |
| Next hash, types | The next hashed name, and types at this name. | Base32hex, type list. |
Check an NSEC3 record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid NSEC3 record.
| Part | What it means |
|---|---|
| Name1avvqn74sg75ukfvf25dgcethgq638ek.example.com. | A full name: the final dot means nothing is added to it. |
| TTL300 | Resolvers may keep this answer for 5 minutes before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeNSEC3 | DNSSEC hashed proof of non-existence. |
| Hash algorithm1 | 1: SHA-1, the only one defined. |
| Flags0 | 0: no opt-out. |
| Iterations0 | 0 extra hash rounds, the current recommendation. |
| Salt- | No salt, the current recommendation. |
| Next hashed name1avvqn74sg75ukfvf25dgcethgq638el | The next hash in order. No name hashes to anything between this one and the next. |
| TypesA RRSIG | The record types at the original name. |
Examples
Recommended settings
1avvqn74sg75ukfvf25dgcethgq638ek.example.com. 300 IN NSEC3 1 0 0 - 1avvqn74sg75ukfvf25dgcethgq638el A RRSIG
No opt-out, zero iterations, no salt.
TTL
The SOA minimum. How TTL works
Common mistakes
- High iteration counts. Above about 100, many resolvers treat the zone as unsigned or fail.
At your DNS host
- Chosen in your signer's settings; managed hosts pick it for you.
Questions
NSEC or NSEC3?
If you run your own signer and don't mind the zone being listable, NSEC is simpler. Otherwise NSEC3 with 0 iterations and no salt.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free