NSECRecordValidator
class NSECRecordValidator implements DnsRecordValidatorInterface (View source)
NSEC record validator
Validates NSEC (Next SECure) records according to:
- RFC 4034: Resource Records for the DNS Security Extensions
- RFC 3845: DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format
- RFC 4035: Protocol Modifications for the DNS Security Extensions
NSEC records are used in DNSSEC to provide authenticated denial of existence. They form a chain of all domain names in a zone, proving which names exist and which do not. Each NSEC record contains:
- Next Domain Name: The next owner name in canonical ordering of the zone
- Type Bit Maps: The set of RR types present at the NSEC RR's owner name
Format: next-domain-name [type-bit-maps] Example: example.com. A NS SOA MX TXT AAAA
Security considerations:
- NSEC records enable "zone walking" (discovering all names in a zone)
- For privacy concerns, NSEC3 (RFC 5155) can be used as an alternative
- NSEC records should have the same TTL as the SOA minimum TTL
Type code: 47
Methods
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validate an NSEC record
Details
__construct(ConfigurationManager $config)
No description
ValidationResult
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validate an NSEC record