# NSEC3PARAM record

An NSEC3PARAM record at the zone's root tells authoritative servers which NSEC3 settings (hash, iterations, salt) the zone uses, so they can find the right NSEC3 records to send.

- Record type: NSEC3PARAM
- Type number: 51
- Used for: DNSSEC
- How common: Specialist
- Defined in: RFC 5155

## Format

```
@ <ttl> IN NSEC3PARAM <hash algorithm> <flags> <iterations> <salt>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Hash algorithm | Always 1. | `1` |
| Flags | Always 0 here. | `0` |
| Iterations | Extra hash rounds. | 0 recommended. |
| Salt | Hex salt, or - for none. | `-` recommended. |

## Examples

### Recommended

```
@ 0 IN NSEC3PARAM 1 0 0 -
```

SHA-1, no extra rounds, no salt.

## TTL

0 is common: resolvers don't need to cache it.

## Common mistakes

- Iterations above 0.

## At your DNS host

- Set by the signer.

## Questions

### Do resolvers use NSEC3PARAM?

No. It's for the zone's own servers. Resolvers read the parameters from the NSEC3 records they receive.

## Related

- [NSEC3 record](https://lemon.domains/dns-records/nsec3.md)
- [NSEC record](https://lemon.domains/dns-records/nsec.md)
- [DNSKEY record](https://lemon.domains/dns-records/dnskey.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/nsec3param