# NSEC3 record

NSEC3 does the same job as NSEC, proving a name doesn't exist, but with hashed names so the zone can't simply be listed. Large TLDs such as .com use it with opt-out, which skips unsigned delegations. Current advice is zero extra iterations and no salt.

- Record type: NSEC3
- Type number: 50
- Used for: DNSSEC
- How common: Specialist
- Defined in: RFC 5155, RFC 9276

## Format

```
<hash>.<zone> <ttl> IN NSEC3 <hash algorithm> <flags> <iterations> <salt> <next hash> <types...>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Hash algorithm | Always 1 (SHA-1). | `1` |
| Flags | 1 means opt-out. | 0 or 1. |
| Iterations | Extra hash rounds. | 0 recommended (RFC 9276). |
| Salt | Added before hashing. | `-` (none) recommended. |
| Next hash, types | The next hashed name, and types at this name. | Base32hex, type list. |

## Examples

### Recommended settings

```
1avvqn74sg75ukfvf25dgcethgq638ek.example.com. 300 IN NSEC3 1 0 0 - 1avvqn74sg75ukfvf25dgcethgq638el A RRSIG
```

No opt-out, zero iterations, no salt.

## TTL

The SOA minimum.

## Common mistakes

- High iteration counts. Above about 100, many resolvers treat the zone as unsigned or fail.

## At your DNS host

- Chosen in your signer's settings; managed hosts pick it for you.

## Questions

### NSEC or NSEC3?

If you run your own signer and don't mind the zone being listable, NSEC is simpler. Otherwise NSEC3 with 0 iterations and no salt.

## Related

- [NSEC3PARAM record](https://lemon.domains/dns-records/nsec3param.md)
- [NSEC record](https://lemon.domains/dns-records/nsec.md)
- [RRSIG record](https://lemon.domains/dns-records/rrsig.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/nsec3