Authenticated Denial of Existence in the DNS, February 2014
- Canonical URL:
- File formats:
- R. Gieben
Discuss this RFC: Send questions or comments to firstname.lastname@example.org
Authenticated denial of existence allows a resolver to validate that a certain domain name does not exist. It is also used to signal that a domain name exists but does not have the specific resource record (RR) type you were asking for. When returning a negative DNS Security Extensions (DNSSEC) response, a name server usually includes up to two NSEC records. With NSEC version 3 (NSEC3), this amount is three.
This document provides additional background commentary and some context for the NSEC and NSEC3 mechanisms used by DNSSEC to provide authenticated denial-of-existence responses.
For the definition of Status, see RFC 2026.
For the definition of Stream, see RFC 4844.