NSEC3RecordValidator

NSEC3 record validator

Validates NSEC3 (Next SECure version 3) records according to:

• RFC 5155: DNS Security (DNSSEC) Hashed Authenticated Denial of Existence
• RFC 9276: Guidance for NSEC3 Parameter Settings (Best Current Practice)
• RFC 9077: NSEC and NSEC3: TTLs and Aggressive Use

NSEC3 records provide authenticated denial of existence in DNSSEC with additional protection against zone enumeration. Each NSEC3 record contains:

Format: [hash-algorithm] [flags] [iterations] [salt] [next-hashed-owner-name] [type-bit-maps] Example: 1 0 0 - B4Q3JBMLEL2C7EMPGKUDAMPIP4DI4C2L A NS SOA MX RRSIG DNSKEY NSEC3PARAM

Field descriptions:

1. Hash Algorithm: The algorithm used for hashing (1 = SHA-1, the only defined value)
2. Flags: The Opt-Out flag (bit 0) indicates whether NSEC3 covers unsigned delegations
3. Iterations: Number of additional hash iterations (RFC 9276 recommends 0)
4. Salt: Random value to defend against pre-calculated attacks (RFC 9276 recommends "-")
5. Next Hashed Owner Name: Base32hex encoded next hashed owner name in hash order
6. Type Bit Maps: Set of RR types present at the original owner name

Security considerations:

• While more resistant than NSEC, NSEC3 records can still be susceptible to zone enumeration
• RFC 9276 recommends using 0 iterations as additional iterations provide minimal security benefit
• RFC 9276 recommends not using a salt (indicated by "-") to simplify operation
• NSEC3 records should have the same TTL as the SOA minimum TTL field
• Validating resolvers may reject zones with high iteration values (>100)

Type code: 50