NSEC3PARAMRecordValidator

NSEC3PARAM record validator

Validates NSEC3PARAM (NSEC3 Parameters) records according to:

• RFC 5155: DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
• RFC 9276: Guidance for NSEC3 Parameter Settings (Best Current Practice)
• RFC 9077: NSEC and NSEC3: TTLs and Aggressive Use

NSEC3PARAM records provide the parameters needed by authoritative servers to calculate hashed owner names for NSEC3 records. The NSEC3PARAM RR is used by servers to select the appropriate NSEC3 records for negative responses.

Format: [hash-algorithm] [flags] [iterations] [salt] Example: 1 0 0 -

Field descriptions:

1. Hash Algorithm: The algorithm used for hashing (1 = SHA-1, the only defined value)
2. Flags: The Opt-Out flag (bit 0) indicates whether NSEC3 covers unsigned delegations
3. Iterations: Number of additional hash iterations (RFC 9276 recommends 0)
4. Salt: Random value to defend against pre-calculated attacks (RFC 9276 recommends "-")

Security considerations:

• NSEC3PARAM records MUST only be present at the zone apex
• Unlike NSEC3 records, NSEC3PARAM records do not include the "next hashed owner name" or "type bit maps"
• RFC 9276 recommends using 0 iterations as additional iterations provide minimal security benefit
• RFC 9276 recommends not using a salt (indicated by "-") to simplify operation
• Validating resolvers may reject zones with high iteration values (>100)

Type code: 51