NSEC Lookup
An NSEC record is DNSSEC’s signed proof that a name or record type does not exist in a zone. This lookup shows the NSEC records a signed zone returns for a name.
When to use this: You are debugging negative answers in a DNSSEC-signed zone. Command prefix nsec:
About the NSEC Lookup
Look up NSEC records, which prove that a name or record type does not exist in a signed zone.
FAQ
- Can NSEC reveal my zone contents?
- Yes, NSEC chains can be walked to list names. NSEC3 hashes names to make that harder.
- Do I configure NSEC myself?
- Normally your DNS host generates NSEC or NSEC3 automatically when signing.