NSEC Lookup
Next Secure record (authenticated denial).
Enter a value above to run NSEC Lookup
e.g. example.com
Quick answer
NSEC Lookup shows the DNSSEC record used to prove that a name or record type does not exist, in a way resolvers can cryptographically verify. Each NSEC record points to the next existing name in the zone and lists which record types the current name has, so any name that falls in the gap is provably absent.
NSEC Lookup queries the NSEC (Next Secure) records a DNSSEC-signed zone returns when you ask for a name or record type that does not exist. Instead of an unsigned "no such name" answer, an authoritative server hands back a signed NSEC record proving the absence, so a resolver can trust the denial. This tool lets you inspect those authenticated denial-of-existence records directly, which is useful when debugging negative answers, verifying that a zone was signed correctly, or confirming which record types actually exist at a name.
How it works
In a signed zone, every existing name is linked to the next name in canonical order, forming a chain. When you query a missing name, the server returns the NSEC record of the closest existing name before it. That record lists the next owner name in the chain plus a type bitmap of the record types that do exist at the current name. Because the record is signed with an RRSIG, the resolver can prove the queried name falls in a gap and therefore does not exist.
How to read the results
Each NSEC record shows three key parts: the owner name, the next owner name, and a type bitmap. If you query a name and get back NSEC covering example.com to www.example.com, everything alphabetically between those two names is proven absent. The type bitmap (for example A, AAAA, RRSIG, NSEC) tells you exactly which record types are present at the owner name. A missing type in the bitmap is a signed proof that this type does not exist there.
Why it matters
NSEC is what makes a DNSSEC "no" as trustworthy as a DNSSEC "yes." Without it, an attacker could forge negative answers to hide a legitimate record or fake that a name is gone. One well-known trade-off is zone walking: because NSEC reveals the next existing name, anyone can enumerate every name in the zone by following the chain. If that exposure is a concern, NSEC3 uses hashed names to make enumeration harder while still proving non-existence.
Frequently asked questions
- What is the difference between NSEC and NSEC3?
- Both provide authenticated denial of existence, but NSEC lists the next name in plaintext, so the whole zone can be walked and enumerated. NSEC3 replaces plaintext names with salted hashes, making enumeration much harder. NSEC is simpler and lighter; NSEC3 adds privacy at the cost of extra CPU. A zone uses one or the other, not both.
- Why did my NSEC lookup return nothing?
- The most common reason is that the zone is not DNSSEC-signed, so no NSEC records exist to return. You may also get nothing if the name you queried actually exists, since NSEC is only used for negative answers. Check that the parent has a DS record and that the resolver path allows DNSSEC before assuming the zone is broken.
- Can NSEC records expose my zone contents?
- Yes. Because each NSEC record points to the next name in the zone, someone can start at one name and follow the chain until they have listed every name you host. This is called zone walking. If your zone contains names you would rather keep private, switch to NSEC3, which hashes owner names, or reconsider what you publish in DNS at all.