NSEC3PARAM
The NSEC3PARAM record tells nameservers which hash algorithm, iteration count, and salt a signed zone uses for hashed denial of existence. This lookup shows those parameters so you can check them against current guidance, which recommends zero extra iterations.
When to use this: You run a DNSSEC-signed zone with NSEC3 and want to confirm its hashing parameters. Command prefix nsec3param:
About the NSEC3PARAM
Show the NSEC3 hash algorithm, iterations and salt a signed zone uses.
FAQ
- What iteration count should I use?
- Current guidance (RFC 9276) is zero extra iterations and no salt.
- Does this affect performance?
- High iteration counts cost resolvers CPU, and some validators treat very high counts as insecure.