NSEC3PARAM record
An NSEC3PARAM record at the zone's root tells authoritative servers which NSEC3 settings (hash, iterations, salt) the zone uses, so they can find the right NSEC3 records to send.
| Record type | NSEC3PARAM |
|---|---|
| Type number | 51 |
| Used for | DNSSEC |
| How common | Specialist |
| Defined in | RFC 5155 |
Format
@ <ttl> IN NSEC3PARAM <hash algorithm> <flags> <iterations> <salt>
| Field | What it means | Accepted values |
|---|---|---|
| Hash algorithm | Always 1. | 1 |
| Flags | Always 0 here. | 0 |
| Iterations | Extra hash rounds. | 0 recommended. |
| Salt | Hex salt, or - for none. | - recommended. |
Check an NSEC3PARAM record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid NSEC3PARAM record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL0 | 0: resolvers shouldn't cache this answer at all. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeNSEC3PARAM | Settings for NSEC3. |
| Hash algorithm1 | 1: SHA-1, the only one defined. |
| Flags0 | Must be 0 here. |
| Iterations0 | 0 extra hash rounds, as recommended. |
| Salt- | No salt, as recommended. |
Examples
Recommended
@ 0 IN NSEC3PARAM 1 0 0 -
SHA-1, no extra rounds, no salt.
Look up NSEC3PARAM records
TTL
0 is common: resolvers don't need to cache it. How TTL works
Common mistakes
- Iterations above 0.
At your DNS host
- Set by the signer.
Questions
Do resolvers use NSEC3PARAM?
No. It's for the zone's own servers. Resolvers read the parameters from the NSEC3 records they receive.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free